SP-API Security Best Practices for Sellers and Their Partners

Connecting software to your Amazon account through the Selling Partner API is powerful, but access must be controlled. Learn how authorization works and what to require from any third-party tool.

How SP-API authorization works

The Selling Partner API is Amazon's modern interface for programmatic access to seller data and operations, replacing the older MWS. Third-party applications are registered by developers, who must meet Amazon's policies, and sellers grant access through an OAuth-based authorization flow from Seller Central. The seller does not share a password; instead, the application receives tokens that allow it to call specific APIs on the seller's behalf.

Applications request roles that correspond to categories of data and actions, such as inventory, pricing, product listings or orders. Access to personally identifiable information like buyer names and addresses is restricted further and requires additional vetting by Amazon.

Authorization can be reviewed and revoked by the seller at any time from Seller Central. This is an important control: if you stop using a tool or have any doubt about it, revoke its access immediately.

The principle of least privilege

Grant applications only the roles they need for the functions you actually use. A tool that only analyzes advertising performance does not need access to buyer contact information. When evaluating a vendor, ask which roles it requests and why each one is necessary.

Within your own organization, apply the same principle to Seller Central user permissions. Each staff member and contractor should have an individual login with only the permissions their job requires. Shared logins make it impossible to trace who did what and are a common source of security incidents.

Review permissions periodically, for example every quarter, and remove access for people and applications that no longer need it. Departures and vendor changes are the moments when forgotten access most often lingers.

What to ask of any third-party developer

Before authorizing a tool, ask how it stores and protects your data. Reasonable expectations include encryption in transit and at rest, secure storage of refresh tokens and credentials, access controls and logging for the vendor's own staff, and a documented incident response process. Amazon's Data Protection Policy sets requirements in these areas for developers that handle certain data.

Ask about data retention and deletion. How long does the vendor keep order data and especially personal information? Can data be deleted on request, and what happens when you terminate the contract? Personal information should be kept only as long as needed for the specific purpose.

For tools using AI, ask whether your data is used to train models, and if so, whose. Many sellers are comfortable with their data improving their own forecasts but not with it being sent to train third-party models. A clear written policy on this is a good sign of a mature vendor.

Protecting your own account and data

Enable two-step verification for every Seller Central user and protect the email accounts associated with them, since email compromise is a common route to account takeover. Be cautious of phishing emails that imitate Amazon notifications, and train staff to verify requests through Seller Central itself rather than links in messages.

If you download reports containing buyer information, treat them as sensitive. Store them only in controlled locations, avoid emailing them, and delete them when no longer needed. Many data protection laws, including Japan's APPI and the EU's GDPR, apply to this information, and Amazon's policies restrict how it may be used.

Keep a simple inventory of all applications connected to your accounts, who owns each relationship and what data it accesses. This record makes it much easier to respond quickly if a vendor reports an incident.

Monitoring and incident response

Watch for unusual activity: unexpected listing changes, price changes you did not make, new users or applications, or sudden changes in disbursement settings. Prompt detection limits damage, and many problems turn out to be misconfigured tools rather than malicious actors, which is still worth catching early.

Prepare a short incident plan in advance. It should cover who revokes application access, who contacts Amazon Seller Support, who notifies affected parties if personal information is involved, and how to restore correct prices and listings. Rehearsing the plan once makes a real incident far less chaotic.

At KeyCenter, integrations run through Amazon's authorization flows with role-based access limited to what each agent needs, and customer data is not used to train third-party models without consent. We encourage every seller to hold all their vendors, including us, to the standards described here.