Vinted API: what you can really do in 2026

Does Vinted have a public API?

No, not officially. Vinted has not documented a public API for third-party developers (unlike eBay, Etsy or Shopify). No API key to request, no official docs.

But Vinted does have an internal API

Every click on Vinted (app, web) calls REST endpoints. These endpoints live in the Vinted web app source code and are reachable via standard HTTP fetch if you know their structure.

Examples of internal endpoints (public in the "not secret" sense):

– /api/v2/users/current: info on the logged-in user
– /api/v2/items: list items
– /api/v2/items/{id}: item detail
– /api/v2/conversations: conversations
– /web/api/notifications/notifications: notifications (favourites, messages)

How to call them

You send HTTP requests with:
– Your session cookie (obtained after browser login)
– X-CSRF-Token header (extracted from the page's meta tag)
– X-Anon-Id header (extracted from cookies)

What you can do

– List your items, favourites, sales, messages
– Relist, edit, delete your listings
– Send messages to buyers
– Send offers to favouriters
– Download shipping labels
– Internal stats (views, favourites per item)

What you can NOT do

– Buy on behalf of another user
– Edit other users' listings
– Access other users' private info (addresses, IBAN)
– Mass-scrape without hitting rate limits (429 errors)

Technical risks

Rate limits

Vinted enforces frequency limits (~10-30 req/min depending on endpoint). Beyond that: 429 Too Many Requests, temporary 5-30 min lockout.

Bot detection

Vinted analyzes request patterns (regularity, headers, fingerprint). Bot detected = shadowban or suspension.

Shifting API

Vinted regularly changes its internal endpoints. Code that worked 6 months ago might not work today. No stability guarantee.

Legality

Using the Vinted internal API sits in a gray area. Vinted's ToS forbid scraping and excessive automation. See our article on the legality of automation.

Existing tools

Extensions (Redrip, Dotb, Vintup) use the internal API. Cloud bots (Clemz, Bleam) too, but with higher risks (shared IPs).