Overview

Amazon has promoted the Application Management API version 2023‑11‑30 from its sandbox environment to the live Production platform. The new endpoint enables sellers and developers to rotate the client secret linked to their Login with Amazon (LWA) credentials automatically. Because the change spans every Amazon marketplace, any seller that relies on LWA for authentication must adjust their integration workflow.

Key Points

• Production availability — As of the announced rollout date, the 2023‑11‑30 API version is fully active on Amazon’s Production servers.
• Automated secret rotation — Sellers can now replace LWA client secrets through a REST call, removing the need to edit secrets manually in Seller Central.
• Global marketplace reach — The endpoint works across all Amazon marketplaces, from the United States and Canada to European and Asian sites, affecting every LWA‑enabled seller.
• Enhanced security posture — Regular, programmatic secret changes lower the chance of credential leakage and align with industry‑standard security practices.
• Developer‑friendly design — The API follows conventional REST patterns, accepts JSON payloads, and returns clear HTTP status codes, making it straightforward to embed in existing automation scripts.

How the Application Management API Works

1. Create a rotation request — The seller issues a POST to /applications/{applicationId}/rotateClientSecret, supplying the current clientId and a newly generated secret in the request body.
   • Example payload:

     {
       "clientId": "amzn1.application-oa2-client.abcdef1234567890",
       "newClientSecret": "Z9y8X7w6V5u4T3s2R1q0pO"
     }
     

2. Amazon validates the call — Amazon confirms that the supplied clientId belongs to the caller’s developer account, checks that the new secret satisfies complexity requirements, and verifies the LWA access token used for authentication.