Overview

Amazon is updating three foundational policy documents that dictate how developers and sellers interact with its API services: the Amazon API Services Developer Agreement, the Data Protection Policy (DPP), and the Acceptable Use Policy (AUP). The revisions become enforceable on 22 August 2022, giving the marketplace roughly a month for users to review and adjust their integrations. Sellers who rely on Amazon APIs must understand the new security, privacy, and usage rules to keep their storefronts operational and avoid interruptions.

Key Points

• Effective date — All three policies take effect on 22 August 2022, creating a short compliance window for existing integrations.
• Credential rotation — The revised Developer Agreement now obligates developers to rotate API secret keys at least once every 90 days, tightening protection against credential leakage.
• Explicit consent & encryption — The DPP requires documented buyer consent before any personally identifiable information (PII) is stored, and it mandates encryption of that data while at rest.
• Usage restrictions — The updated AUP bans high‑frequency price‑scraping bots and bulk order‑placement scripts that could manipulate marketplace dynamics.
• Compliance audits — Amazon will perform periodic checks; applications that fail to meet the new standards risk suspension or revocation of API access.
• Unified documentation — All three policies are now housed in a single searchable “API Governance” portal, simplifying reference for developers.

How the Updates Work

1. Credential rotation schedule — Developers must create a process that generates a new access key, updates every integration point, and disables the old key before the 90‑day deadline. For example, a seller using the MWS Orders API could schedule a Lambda function to issue a fresh key, rewrite the configuration file, and retire the previous key automatically each quarter.
2. Buyer consent capture — Any system that records buyer email, shipping address, or purchase history must first obtain a clear opt‑in from the user. A typical implementation adds a mandatory checkbox to a third‑party order‑management dashboard; the checkbox state is stored alongside the data in an encrypted MySQL column, ensuring both consent and protection are recorded.