AtlasCore Market

Newegg Legal addendum · Legal version v1 · Last updated: July 13, 2026

Newegg Marketplace API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Newegg Marketplace Partner API developer and seller agreement requirements for connected Newegg seller accounts.

Independent application status

AtlasCore is an independent software application. Newegg and related marks are trademarks of Newegg Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Newegg.

Authorized API use

AtlasCore accesses Newegg Marketplace APIs only after explicit seller authorization via per-seller Authorization Key, Secret Key, and Seller ID. Live server-side reads are focused on order synchronization and connection health validation. `GetInventoryRequest` is used for read-only catalog and stock inquiries when item lookups are performed. Seller writes (`UpdateInventoryRequest`) run only when `NEWEGG_WRITE_APPROVED` is also true. Inbound webhooks never mutate stock.

AtlasCore does not scrape the Newegg Seller Portal or use undocumented data extraction methods. Catalog listing sync is not a primary Newegg spoke surface; order ingest and optional inventory writes are the supported integration scope.

Data handling controls

- Credential encryption: Authorization Keys, Secret Keys, and optional webhook secrets are encrypted at rest (AES-256-GCM, `enc:v1:` prefix)

  • Transport security: Production traffic uses TLS 1.2+ (HTTPS)
  • Tenant isolation: Each AtlasCore user may link their own Newegg seller account; one active `seller_id` is allowed platform-wide. Cross-user seller access is denied at the API layer
  • Webhooks: Incoming Newegg webhooks require raw-body HMAC-SHA256 verification (`X-Newegg-Signature`) first, before timestamp freshness or event persistence or dispatch. A dedicated webhook secret is required — API Secret Keys are never used as HMAC material. After HMAC verification, a bounded parse may run solely to bind `seller_id` to the merchant account. Replay keys persist in `newegg_processed_webhook_events` after disconnect
  • Order data: Only operational fields (order number, status, totals, currency, dates, line SKU/qty) are stored. Customer, shipping, billing, and contact fields are not persisted. Seller dashboard GETs return cache-only sanitized rows. Live server-side reads run strictly for seller-initiated sync POSTs (`POST /sync/`), `GET /status/` health probes, and credential validation

Rate limits & API discipline

- AtlasCore respects Newegg API rate limits and implements backoff on throttled responses

  • Sync jobs are batched to minimize redundant API calls
  • Failed requests are retried with exponential backoff

Seller controls

- Disconnect Newegg in AtlasCore to stop sync and purge stored credentials

See our Privacy Policy and Disconnect Marketplace guide.