01 / Where
It works in the tab you are signed in to
Every read and every change is a request made from inside your own Vinted page, so the browser attaches your session to it exactly as it does when you click something yourself.
Vinted bots
What people mean by a Vinted bot, and what Cavri is.
A Vinted bot, as the word is normally used, is software that signs in as you and works the site on its own. Cavri is a Chrome extension: it acts inside the Vinted tab you are already signed in to, on listings that are already yours, one queued job at a time.
The requests that change a listing are made from inside the Vinted page, carrying the session your own browser already has. No Cavri server holds your Vinted login, because nothing in Cavri is ever given it.
What follows is what the extension asks Chrome for, what happens between pressing a button and Vinted changing, and where Vinted's own rules sit in all of it.
Three Chrome permissions · one marketplace · your own signed-in session
Relist queueDue today: 14
Linen wide-leg trousersLive 41 days · relisted twice
Due
Wool field jacketLive 33 days · never relisted
Due
Leather crossbody bagLive 12 days
In 18 days
Eligible after 30 daysDaily ceiling: 20 actions
02 / Permissions
Three permissions and one marketplace
Tabs, alarms and storage, plus Vinted's ten national sites and your own Cavri workspace. Chrome reads that list out before you install anything, which makes it the one description of an extension its author does not write.
03 / Pace
One job, then a gap
Jobs are taken one at a time, roughly a minute apart, with the gap varied rather than fixed, whether you queued the batch yourself or a rule did. What the rules may queue on their own has a ceiling on top of that: 20 actions a day to start with, anything from 1 to 500.
From pressing a button to Vinted changing
One action, in order, from the moment you ask for it. A rule you switched on enters at the same place a button does.
- You queue it, Select items in Cavri and press relist, or accept an offer, or publish a draft. That writes a row to a list held in your own Cavri account. Nothing has happened on Vinted, and the row is there to look at.
- It is given a time, The row is scheduled about a minute behind whatever is already waiting, and the exact gap is varied so it is not the same interval every time. Queue fifty and they spread across the next hour or so instead of arriving together.
- The extension asks, Once a minute a Chrome alarm wakes the extension and it asks your Cavri account one question: is anything due. Most of the time the answer is no, and it stops there.
- It takes one job, A single job, not the list. Anything scheduled for later is not handed over early.
- It finds your tab, It asks Chrome for a tab open on Vinted and uses that one, or opens one in the background if you have none. A session that has gone stale is renewed by Vinted's own refresh page. If the session is genuinely gone, the job stops there and says so.
- The request goes out as you, The call is made from inside your own Vinted page, and the browser attaches your session to it the same way it does when you press something on the site by hand.
- The answer is recorded, What ran, when, and what came back, with the reason if it failed. A failure that came back with a reason waits for you rather than being tried again on its own.
- Then it waits, Back to one question a minute. The next job in the queue is not due yet.
Close Chrome and the queue stops where it is, and there is nowhere else for it to run. One queued job is one action, and a rule you switched on may queue 20 of them a day to begin with, which is a number you set.
What Chrome asks you to allow
Chrome shows this before you install anything, and it is the whole of what the extension asks for.
| What Chrome lists | What it is for | What that covers |
|---|---|---|
| Tabs | Finding the Vinted tab you are already signed in to, handing it one job, and reading the answer that comes back. | It works in a tab you already have open, or opens one in the background rather than taking over the window you are using. A wardrobe scan gets a background tab of its own, and it is closed again when the scan finishes. |
| Alarms | A timer that goes off once a minute and asks your own Cavri account whether anything is queued. | That is the whole of what the alarm does. When the answer is nothing, which it usually is, the extension goes back to sleep without opening a thing. |
| Storage | Four things: the address of your Cavri workspace, your Cavri API key, what the extension is doing right now, and the short-lived token Vinted's own page hands out to show a request came from that page. | The queue itself lives in your Cavri account rather than here, which is why closing Chrome pauses a batch instead of losing it. Your Vinted password and the cookie you are signed in with are in neither. |
| Vinted's ten national sites | The only marketplace it touches. Each site is listed separately because a browser cannot be asked for Vinted as one thing. | vinted.co.uk, .fr, .de, .es, .it, .nl, .be, .pl, .cz and .lt. |
| Your own Cavri workspace | So the dashboard and the extension can pair in one click instead of you copying a key between them. | One origin, the one you signed up on. Nothing else on the web is in the list. |
That is the list, and it used to be one line longer. An earlier version asked for the permission that lets an extension read the headers on requests the browser makes, which Cavri used to pick up two values Vinted's own page turns out to hand over anyway. It went in version 1.9.0, and what the extension is able to do has matched what it actually does since.
Is a seller tool against Vinted's rules?
Vinted's terms restrict automated access to the site. Read plainly, that covers every tool in this category, Cavri included. Any tool telling you it is exempt is telling you something it has no way to know.
What Cavri does about that is keep the footprint small. The account is yours and you signed into it yourself. The listings are ones you already own. Jobs go through about a minute apart rather than in a burst, whoever queued them, and what the rules queue on their own runs under a daily ceiling you set: 20 to begin with, and you can put it lower.
What it cannot do is promise you an outcome. The terms are Vinted's to interpret and enforcement is Vinted's to carry out, and no seller tool has any standing in either. Cavri is independent of Vinted and has no arrangement with them, and nobody selling software is in a position to tell you the risk is zero.
If that is not a trade you want to make, the manual half works with every rule switched off: the wardrobe, bulk edits inside Cavri, the offers list, the numbers. Nothing changes on Vinted until you press something.
What it never does
- It never asks for your Vinted password. There is nowhere in Cavri to type one.
- The cookie that signs you in is out of reach. Vinted marks that one HttpOnly, which puts it beyond every script running in the page, this one included.
- It never writes a message to a buyer. It reads the inbox to find offers, and what it sends back is a decision on one: accept, decline, or a counter price, which reaches the buyer as an offer rather than as words.
- Following, unfollowing and anything else aimed at another seller are outside what it does, and it touches no listing that is not yours.
- With Chrome closed it does not run, and there is nothing anywhere else that could. That is also why this half of Cavri wants a laptop: Chrome on iOS and Android cannot load extensions.
- The only pages it opens or reads are Vinted's and your own Cavri workspace. Those are the only origins the shipped extension is granted.
Questions about what runs, and where
Is Cavri a Vinted bot?
No. It does not sign into Vinted, it has no account of its own, and it runs nothing on a server. It is a Chrome extension that acts inside the Vinted tab you are already signed in to, on your own listings, when a job you queued or a rule you switched on falls due.
Does Cavri need my Vinted password?
No, and there is nowhere to type one. You sign into Vinted yourself, in your own browser, exactly as you would anyway. Your Cavri login is a separate thing and has nothing to do with your Vinted one.
Does it read my cookies?
One of them, and only as a fallback. Vinted publishes an identifier called anon_id in its own API responses and also sets it as a readable cookie. The extension takes it from the response, and reads the cookie only when a response leaves it out. The cookie that signs you in is a different one and is marked HttpOnly, which puts it beyond every script in the page, Cavri's included.
What runs when I have not asked for anything?
A read, every five minutes or so. Cavri checks whether anything has sold and whether any offers have come in, so a sale does not sit unnoticed and an offer does not expire overnight. It runs even with automation switched off, because it changes nothing, and reads do not count against your daily ceiling. Anything that changes a listing waits either for you or for a rule you turned on yourself.
What happens if I close Chrome?
The queue stops where it is and picks up when you open it again. Whatever had already run stays done. There is nowhere else for it to run, so a laptop that is asleep is a queue that is paused.
This is one part of it. There is a page listing every rule Cavri can run, with its default and its cap.
Vinted seller automationEvery rule and cap
How Cavri worksSeven steps, start to finish
Vinted relisting toolWhat a relist costs you
FAQTwenty-three plain answers
Watch the first one go through.
100 items free, no card. Relisting, the price curve and the offer rules all start switched off, so you can queue one job by hand and watch it go through before you decide about the rest.