Overview

In December 2023 Amazon released the public‑beta version of the Application Management API (v2023‑11‑30). The beta introduces a mandatory 180‑day rotation rule for Login With Amazon (LWA) client secrets and supplies a programmatic endpoint that lets sellers replace those secrets without manual console work. Sellers who depend on SP‑API for inventory, pricing, or order data must update their authentication flows now to avoid 401 errors and keep their data pipelines running.

Key Points

• Beta availability — The Application Management API v2023‑11‑30 moved from private preview to open beta in December 2023, allowing any registered developer to call its endpoints.
• Six‑month secret rule — Amazon will reject any LWA token request that uses a client secret older than 180 days, enforcing a regular rotation schedule for every application.
• Automated secret swap — A new createClientSecret operation lets integrations generate a fresh secret on demand, eliminating the need to copy values from the Developer Console.
• Legacy calls stay functional — Existing SP‑API endpoints keep their signatures, but requests authenticated with an expired secret will return an authentication failure after the rotation deadline.
• Audit‑ready logging — Each rotation event is recorded with a timestamp, application identifier, and the user who initiated the change, simplifying compliance reporting for sellers under internal security policies.
• Sandbox for testing — Participants in the beta gain access to a sandbox that mimics secret expiration, enabling them to validate their rotation scripts before applying changes in production.

How the Application Management API Works

1. Create a fresh secret — The integration invokes the createClientSecret call, supplying the target application ID; for instance, a third‑party fulfillment service may request a new secret for its “FastShipSync” app.
2. Persist the new value — The returned secret is written to a secure store such as AWS Secrets Manager or HashiCorp Vault, and all authentication modules (e.g., a Lambda function that fetches access tokens) are updated to reference the new entry.