AtlasCore Market

Wish Legal addendum · Legal version v1 · Last updated: July 13, 2026

Wish Merchant API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Wish Merchant API developer and seller agreement requirements for connected Wish merchant accounts.

Independent application status

AtlasCore is an independent software application. Wish and related marks are trademarks of ContextLogic Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Wish.

Authorized API use

AtlasCore accesses Wish Merchant APIs only after explicit seller authorization via OAuth 2.0 v3 or seller-supplied manual API tokens. Default requested scopes are read-only (`orders:read merchant:read products:read`). Live server-side reads are focused on order synchronization and connection health validation. Catalog read helpers (`GET /product`) remain latent and are not mounted as a live seller surface. Seller writes (inventory update) run only when `WISH_WRITE_APPROVED` is also true. Inbound webhooks never mutate stock.

AtlasCore does not scrape the Wish Merchant Dashboard or use undocumented data extraction methods. Catalog listing sync is not a primary Wish spoke surface; order ingest and optional inventory writes are the supported integration scope.

Data handling controls

- Credential encryption: OAuth access tokens, refresh tokens, and optional webhook secrets are encrypted at rest (AES-256-GCM, `enc:v1:` prefix)

  • Transport security: Production traffic uses TLS 1.2+ (HTTPS)
  • Tenant isolation: Each AtlasCore user may link their own Wish merchant account; one active `merchant_id` is allowed platform-wide. Cross-user merchant access is denied at the API layer
  • Webhooks: Incoming Wish webhooks require HMAC-SHA256 verification (`X-Wish-Signature`) over the raw request body before timestamp freshness is accepted and before any event persistence or dispatch. After HMAC verification, a bounded parse extracts `merchant_id` for post-HMAC account binding. Replay keys persist after disconnect
  • Order data: Only operational fields (order ID, status, totals, currency, dates, line SKU/qty) are stored. Buyer, shipping, and contact fields are not persisted. Seller dashboard GETs return cache-only sanitized rows. Live server-side reads run strictly for seller-initiated sync POSTs (`POST /sync/`), `GET /status/` health probes, and credential validation

Rate limits & API discipline

- AtlasCore respects Wish API rate limits and implements backoff on throttled responses

  • Sync jobs are batched to minimize redundant API calls
  • Failed requests are retried with exponential backoff

Seller controls

- Disconnect Wish in AtlasCore to stop sync and purge stored credentials

See our Privacy Policy and Disconnect Marketplace guide.