Overview

Amazon has added native passkey support to Seller Central, letting sellers log in with a fingerprint, facial scan, or device PIN instead of a traditional password. The change, announced in early 2024, aims to cut phishing and credential‑theft risks that frequently target high‑value seller accounts.

Key Points

• Passwordless login — Sellers can authenticate using device‑stored cryptographic keys, removing the need to remember or type passwords.
• Biometric verification — The login flow requires a local biometric check (e.g., Touch ID, Face Unlock) before the passkey is sent to Amazon’s servers.
• Multi‑device enrollment — Each device that supports WebAuthn can hold its own passkey, and sellers can register as many devices as they need.
• Team‑level security – Individual user accounts can each have their own passkey, allowing precise permission control and easy revocation when staff change roles.
• Fallback options – Two‑step verification remains active, and sellers can still use a one‑time code if a passkey fails or a device is unavailable.
• Management dashboard – All registered passkeys appear in the Login & Security page, showing device type, marketplace, and creation date for quick audits.

How Passkeys Work

1. Create a cryptographic credential — After signing in with the existing password, Amazon prompts the seller to generate a new key pair on the chosen device. For example, a seller using a Windows 10 laptop with Windows Hello will have the private key stored in the device’s TPM chip.
2. Store the public key with Amazon — The corresponding public key is uploaded to Amazon’s authentication server and linked to the seller’s account. No secret data leaves the device.
3. Biometric unlock at sign‑in — When the seller returns to Seller Central, the browser asks the device to perform a local biometric check. A seller tapping the fingerprint sensor on an iPhone unlocks the private key for that session.
4. — The device signs a server‑issued challenge with the private key; Amazon verifies the signature using the stored public key, confirming the user’s identity without transmitting a password.