Overview

On July 10 Amazon reminded developers that publishing Login with Amazon (LWA) client identifiers or secrets can trigger loss of Selling Partner API (SP‑API) privileges. The original alert used wording that many interpreted as targeting deliberate sharing, leading to confusion. A follow‑up clarification now specifies that any accidental leakage, regardless of intent, may result in credential suspension, a situation sellers integrating with SP‑API must address to keep their data pipelines running.

Key Points

• Public exposure risk — When a client ID or secret appears in a public code base or website, anyone can request a valid token and invoke SP‑API endpoints on the seller’s behalf.
• Potential credential suspension — Amazon’s security monitors can automatically block the offending LWA client, cutting off access to order, inventory, and financial feeds.
• Clarified scope of warning — The revised notice stresses that even unintentional leaks, such as a stray commit, are treated as violations and require immediate remediation.
• Urgent secret rotation — Developers are instructed to generate a new client secret and replace the old value across all environments within 24 hours of discovery.
• Repository audit requirement — A thorough scan of current and historical repository commits must be performed to eradicate any lingering credential fragments.
• Preventive best practices — Amazon advises storing secrets in managed vaults, using environment variables, and tightening IAM role permissions to limit exposure.

How LWA Credentials Work

1. Create application credentials — In the Amazon Developer Console a seller registers an LWA app and receives a unique client identifier together with a 40‑character secret; these values are displayed only once.
2. Request an access token — The application sends a POST request to Amazon’s OAuth endpoint, supplying the client ID, secret, and the appropriate grant type; a successful call returns a bearer token that remains valid for roughly one hour.