Settings

eBay RuName (User tokens) — required URLs

If eBay shows: "URLs must be secure (https://) and should not be eBay's Privacy Policy URL" — that means every RuName field they validate must start with https:// (they reject http://), and your privacy policy link must be yours, not a copy of eBay's official privacy page. You can still use the same path on your HTTPS host for accept/decline (e.g. …/api/ebay/callback).

Because of that rule, plain http://localhost:3000/… usually cannot be saved in the RuName form. For local dev, use the same paths on a public HTTPS endpoint: deploy a preview (e.g. Vercel: https://…vercel.app) or an HTTPS tunnel (ngrok, Cloudflare Tunnel). Set NEXT_PUBLIC_APP_URL to that https:// origin while testing OAuth. A tunnel that stops running causes 503 Tunnel Unavailable.

• Privacy policy URL — https://…/privacy on your deployed or tunneled host (this app includes /privacy). Not /api/ebay/callback, not eBay's policy URL.
• Auth accepted URL — https://…/api/ebay/callback on the same HTTPS origin as NEXT_PUBLIC_APP_URL:

• Auth declined URL — e.g. https://…/settings on the same origin (still https://).