{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"2f7f2cadb54b697a51e1e5ce0df3083e88561d03a7b18b723f3ceb14e40a4af2","entry":{"id":"amazon/selling-partner-api","name":"Amazon Selling Partner API (SP-API) developer registration","vendor":"Amazon","summary":"Create a Solution Provider Portal account with identity verification (documents plus a video call), submit a developer profile (private or public, roles, use cases, security controls) for Amazon's review, then register an app client to get Login with Amazon (LWA) credentials and self-authorize to get a refresh token.","aliases":["sp-api","amazon-sp-api","selling-partner-api","amazon-seller-api"],"category":"commerce","group":"B","homepage":"https://developer-docs.amazon.com/sp-api/","docs":["https://developer-docs.amazon/sp-api/docs/onboarding-step-2-create-an-spp-account","https://developer-docs.amazon/sp-api/docs/onboarding-step-3-create-a-developer-profile","https://developer-docs.amazon/sp-api/docs/register-as-a-private-developer","https://developer-docs.amazon/sp-api/docs/register-as-a-public-developer","https://developer-docs.amazon/sp-api/docs/self-authorization"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"spp-account","url":"https://developer-docs.amazon/sp-api/docs/onboarding-step-2-create-an-spp-account","title":"SP-API onboarding Step 2: Create a Solution Provider Portal account","accessed":"2026-10-25","supports":"Sign in at solutionproviderportal.amazon.com, Register, enrol the Amazon account, choose \"Build applications that use SP APIs\", then verify identity - business location/type/name, company registration number and registered address, phone PIN, primary contact details, upload proof of identity and proof of address, then a video call with an Amazon employee showing photo ID; needs a device with a camera.","kind":"official"},{"id":"developer-profile","url":"https://developer-docs.amazon/sp-api/docs/onboarding-step-3-create-a-developer-profile","title":"SP-API onboarding Step 3: Create a developer profile","accessed":"2026-10-25","supports":"Standard-role profile review typically takes one to two weeks; restricted (PII) roles go through a three-stage review - business, security, and a technical review meeting with an Amazon solution architect.","kind":"official"},{"id":"private-dev","url":"https://developer-docs.amazon/sp-api/docs/register-as-a-private-developer","title":"Register as a private developer (SP-API)","accessed":"2026-10-25","supports":"Private developer registration via Develop Apps (contact info, data access, roles, use cases, security controls, accept the Solution Provider Portal Agreement, AUP and DPP); Amazon opens a case with next steps; respond within five days or the case closes and access stays unchanged; evaluation criteria are not disclosed.","kind":"official"},{"id":"public-dev","url":"https://developer-docs.amazon/sp-api/docs/register-as-a-public-developer","title":"Register as a public developer (SP-API)","accessed":"2026-10-25","supports":"Public developers need a publicly accessible website describing services to Amazon sellers (not under construction, login-only or with security warnings); restricted roles need PII use-case answers and an architecture review (possibly a screen-share demo); restricted review phase 1 checks HTTPS, privacy policy, terms of service and contact details; security free-text answers under 500 characters; case updates go to the administrator email.","kind":"official"},{"id":"register-app","url":"https://developer-docs.amazon/sp-api/docs/registering-your-application","title":"Register your application (SP-API)","accessed":"2026-10-25","supports":"Primary account user signs in to the Solution Provider Portal, Develop Apps, Developer Central, \"Add new app client\", choose API type and seller/vendor; authorization limits apply to public and private apps.","kind":"official"},{"id":"self-auth","url":"https://developer-docs.amazon/sp-api/docs/self-authorization","title":"Self-authorize your application (SP-API)","accessed":"2026-10-25","supports":"\"Authorize app\" generates a long-lived refresh token per account; generating a new one does not invalidate earlier ones; you must be the Primary User of the Seller Central account; LWA client ID and secret are shown in Seller Central, Vendor Central or the Solution Provider Portal.","kind":"official"},{"id":"lwa-rotation","url":"https://developer-docs.amazon/sp-api/docs/rotating-your-apps-lwa-credentials","title":"Rotate your application's LWA credentials (SP-API)","accessed":"2026-10-25","supports":"Rotate LWA client secrets every 180 days; notice 90 days before; old credentials expire seven days after new ones are generated; missing the deadline makes SP-API calls fail.","kind":"official"},{"id":"faq","url":"https://developer-docs.amazon/sp-api/docs/general-faq","title":"SP-API general FAQ","accessed":"2026-10-25","supports":"A professional selling account is not needed to develop or integrate with the SP-API when registering in the Solution Provider Portal.","kind":"official"},{"id":"aup","url":"https://sellercentral.amazon.com/mws/static/policy?documentType=AUP&locale=en_US","title":"Amazon Services API Acceptable Use Policy","accessed":"2026-10-25","supports":"Never share or request access keys or Portal passwords; do not circumvent throttling with multiple accounts or applications; customer PII only for merchant-fulfilled shipping; no targeting customers for marketing or reviews; no pooling data across sellers to sell to third parties; non-compliance may result in suspension or termination; access keys with no successful call in 90 days are deleted.","kind":"official"},{"id":"dpp-pii","url":"https://developer-docs.amazon/sp-api/docs/protecting-amazon-api-applications-data-encryption-and-recovery","title":"Protect Amazon API applications - data retention and recovery","accessed":"2026-10-25","supports":"Data Protection Policy - retain PII no longer than 30 days after order delivery unless law requires.","kind":"official"},{"id":"dpp-update","url":"https://developer-docs.amazon/sp-api/changelog/updates-to-the-data-protection-policy-and-acceptable-use-policy","title":"Updates to the Data Protection Policy and Acceptable Use Policy (effective 25 November 2025)","accessed":"2026-10-25","supports":"DPP adds account lockout after ten failed logins, TLS 1.2+, a key management system, an incident point of contact, 18-month limit on non-PII data, 12-month log retention, critical vulnerabilities fixed within seven days.","kind":"official"},{"id":"fees-reversal","url":"https://ppc.land/amazon-drops-sp-api-fees-after-developer-pushback","title":"Amazon drops SP-API fees after developer pushback (PPC Land)","accessed":"2026-10-25","supports":"Reports that Amazon cancelled the announced $1,400 annual fee and GET-call usage fees for third-party developers, saying it \"will not move forward with the SP-API usage and annual fees at this time\". [to verify against an Amazon page]","kind":"community"}],"allowed_domains":["solutionproviderportal.amazon.com","sellercentral.amazon.com","developer-docs.amazon","developer-docs.amazon.com"],"account_model":{"summary":"A Solution Provider Portal account (linked to an Amazon login and verified business) holds one developer profile that sets private or public data access and approved roles. App clients registered under it get LWA credentials; each selling partner account that authorizes an app yields a refresh token.","accounts":[{"name":"Amazon login (primary user)","kind":"personal","owned_by":"the person","required":true,"note":"App registration and self-authorization need the primary account user."},{"name":"Solution Provider Portal account","kind":"organisation","owned_by":"the business","parent":"Amazon login (primary user)","required":true,"note":"Identity verification is done by the administrator for themselves and the company."},{"name":"Developer profile","kind":"developer","parent":"Solution Provider Portal account","required":true,"note":"Private (own business only) or public (Appstore apps serving other sellers); roles decide which APIs and data you can use."},{"name":"App client","kind":"project","parent":"Developer profile","required":true,"note":"Has an LWA client ID and client secret; secret must be rotated every 180 days."},{"name":"Seller Central or Vendor Central account","kind":"other","required":false,"note":"The selling account whose data the app reads; it authorizes the app and yields a refresh token."}],"notes":["A professional selling account is not needed to develop against SP-API from the Solution Provider Portal.","Restricted roles (PII, e.g. buyer names and addresses) add a three-stage review including a call with an Amazon solution architect."]},"have_ready":[{"kind":"government_id","description":"Government-issued photo ID or passport of the primary contact, scanned, plus the original for the video call","needed_for":["verify-identity"],"auto_check":"none","source":"spp-account"},{"kind":"proof_of_address","description":"Recent bank or credit card statement as proof of address","needed_for":["verify-identity"],"auto_check":"none","source":"spp-account"},{"kind":"company_documents","description":"Business licence (if applicable), company registration number and registered business address","needed_for":["verify-identity"],"auto_check":"name_consistency","source":"spp-account"},{"kind":"phone_for_2fa","description":"Phone to receive a PIN by SMS or call during verification","needed_for":["verify-identity"],"auto_check":"none","source":"spp-account"},{"kind":"other","description":"A device with a video camera for the identity verification video call","needed_for":["verify-identity"],"auto_check":"none","source":"spp-account"},{"kind":"live_website","description":"Public HTTPS website describing your services to Amazon sellers, with privacy policy, terms of service and contact details (public developers)","why":"Inaccessible, under-construction, login-only or insecure sites are not accepted.","needed_for":["developer-profile"],"auto_check":"website_live","source":"public-dev"},{"kind":"other","description":"Written use cases and security-control answers (free text under 500 characters) matching how you meet the AUP and Data Protection Policy","needed_for":["developer-profile"],"auto_check":"none","source":"public-dev"}],"steps":[{"id":"spp-register","title":"Register for the Solution Provider Portal","summary":"Sign in with your Amazon login, choose Register, acknowledge the setup terms, enrol your Amazon account and pick \"Build applications that use SP APIs\". You press each button yourself.","route":"guided","depends_on":[],"gate":"human_terms","url":"https://solutionproviderportal.amazon.com/","sources":["spp-account"]},{"id":"verify-identity","title":"Verify your identity (documents and video call)","summary":"Enter business details, verify your phone with a PIN, upload proof of identity and address, then join a video call with an Amazon employee and show your photo ID. verapli never uploads documents.","route":"guided","depends_on":["spp-register"],"gate":"human_identity","url":"https://solutionproviderportal.amazon.com/","sources":["spp-account"]},{"id":"developer-profile","title":"Submit the developer profile (private or public)","summary":"Under Develop Apps, complete contact information, data access (private or public), roles, use cases and security controls, accept the Solution Provider Portal Agreement, Acceptable Use Policy and Data Protection Policy, and register. Amazon opens a case with next steps.","route":"guided","depends_on":["verify-identity"],"gate":"third_party_review","url":"https://solutionproviderportal.amazon.com/","lead_time":{"official":{"text":"Review for standard (non-restricted) roles typically takes one to two weeks; restricted PII roles go through a longer three-stage review (no time given).","source":"developer-profile"}},"recovery":[{"hiccup":"Amazon asks for more information on the case.","fix":"Reply within five days; unanswered cases are closed and your SP-API access stays unchanged, so you would have to resubmit.","source":"private-dev"},{"hiccup":"Public developer profile rejected for the website.","fix":"Make the site public over HTTPS with no security warnings, describe your services to Amazon sellers, and add privacy policy, terms and contact details.","source":"public-dev"},{"hiccup":"Restricted (PII) role requested.","fix":"Prepare a data-flow architecture, storage and incident response description for the security and technical reviews, or drop the role if you do not need PII.","source":"developer-profile"}]},{"id":"register-app","title":"Register an app client","summary":"As primary user, open Develop Apps, choose \"Add new app client\", select the API type and seller and/or vendor, and save.","route":"guided","depends_on":["developer-profile"],"gate":"human_submit","url":"https://solutionproviderportal.amazon.com/","sources":["register-app"]},{"id":"lwa-credentials","title":"Copy the LWA client ID and client secret","summary":"View the app's LWA credentials in the Solution Provider Portal (or Seller/Vendor Central). verapli captures the secret by selector.","route":"copilot","depends_on":["register-app"],"gate":"none","url":"https://solutionproviderportal.amazon.com/","capture":{"env":"SP_API_LWA_CLIENT_SECRET","kind":"secret"},"sources":["self-auth"]},{"id":"self-authorize","title":"Self-authorize the app to get a refresh token","summary":"As Primary User of the selling account, choose \"Authorize app\" to generate a refresh token. Public apps instead get tokens through the OAuth authorization flow with each seller.","route":"copilot","depends_on":["register-app"],"gate":"human_submit","url":"https://solutionproviderportal.amazon.com/","recovery":[{"hiccup":"Cannot add another authorization.","fix":"The app has hit its authorization limit; review the authorization limits for private and public apps.","source":"self-auth"}],"capture":{"env":"SP_API_REFRESH_TOKEN","kind":"token"},"sources":["self-auth"]}],"outputs":[{"name":"SP_API_LWA_CLIENT_ID","description":"Login with Amazon client ID of the app client","secret":false,"example_format":"amzn1.application-oa2-client.…","from_step":"lwa-credentials"},{"name":"SP_API_LWA_CLIENT_SECRET","description":"Login with Amazon client secret (rotate every 180 days)","secret":true,"from_step":"lwa-credentials"},{"name":"SP_API_REFRESH_TOKEN","description":"Long-lived refresh token for one authorized selling account","secret":true,"example_format":"Atzr|…","from_step":"self-authorize"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Policy breaches end API access","text":"Not complying with the Acceptable Use Policy may lead to suspension or termination of Amazon Services API access.","source":"aup"},{"kind":"rules_say","severity":"red","title":"No multiple accounts to dodge limits","text":"Creating several Solution Provider accounts or applications to get around throttling quotas is prohibited.","source":"aup"},{"kind":"rules_say","severity":"red","title":"Never ask sellers for passwords or keys","text":"Do not request or accept sellers' Amazon passwords or access keys, and never share your own keys.","source":"aup"},{"kind":"rules_say","severity":"amber","title":"Strict PII rules","text":"Customer PII may only be used for merchant-fulfilled shipping and must be deleted within 30 days of order delivery unless law requires otherwise; non-PII data is limited to 18 months.","source":"dpp-pii"},{"kind":"rules_say","severity":"amber","title":"Secrets expire every 180 days","text":"LWA client secrets must be rotated every 180 days; after the deadline SP-API calls fail. Old secrets stop working seven days after you generate new ones.","source":"lwa-rotation"},{"kind":"rules_say","severity":"yellow","text":"Access keys that do not make a successful call in 90 days are deleted.","source":"aup"},{"kind":"people_report","severity":"yellow","title":"Developer fees were announced then dropped","text":"Amazon announced a $1,400 annual fee and GET-call fees for third-party developers in 2026, then reportedly cancelled them. [to verify current status on an Amazon page]","source":"fees-reversal"}],"renewals":[{"what":"Rotate the LWA client secret for every app","every":"180 days","every_days":180,"source":"lwa-rotation"}],"pricing_notes":{"free_tier":"Sellers and vendors using SP-API for their own business were not charged even under the announced 2026 fee plan.","notes":"Third-party developer fees announced for 2026 were reportedly cancelled. [to verify]","source":"fees-reversal"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"Registration, identity verification, the developer profile and app registration are human steps in the Solution Provider Portal. LWA secret rotation can be done programmatically; public apps obtain seller refresh tokens through OAuth.","source":"lwa-rotation"},"detect":{"env_names":["SP_API_LWA_CLIENT_ID","SP_API_LWA_CLIENT_SECRET","SP_API_REFRESH_TOKEN","LWA_CLIENT_ID","LWA_CLIENT_SECRET"],"packages":["amazon-sp-api","python-amazon-sp-api"]}}}