Overview

Amazon now requires every Login With Amazon (LWA) integration to replace its client secret at least twice a year. The rule, first announced on 6 February 2023, originally set a hard deadline for the next 180‑day rotation, but Amazon has recently extended the cutoff to give developers additional preparation time. Sellers who depend on LWA for storefront authentication, advertising APIs, or third‑party management tools must adjust their processes now to stay compliant and avoid service disruptions.

Key Points

• 180‑day renewal cycle — Each LWA client secret must be regenerated no later than 180 days after its creation, meaning a secret issued on 1 January 2024 must be replaced by 30 June 2024.
• Extended rollout window — After reviewing feedback from a global developer survey, Amazon pushed the upcoming rotation deadline back by roughly one month, allowing teams more time for testing and deployment.
• Security hardening — Frequent secret changes shrink the exposure window for compromised credentials, aligning Amazon’s authentication standards with industry frameworks such as NIST SP 800‑57.
• Universal applicability — The rotation rule covers every LWA‑enabled application, from custom checkout widgets and inventory‑sync services to advertising dashboards and analytics platforms.
• Enforcement mechanism — API calls that present an expired or unchanged client secret will be rejected with an authentication error once the new deadline is reached, potentially halting order‑processing or reporting workflows.
• Audit‑ready documentation — Amazon expects developers to keep a change log that records the rotation date, secret identifier, and all services updated, facilitating internal audits and compliance reviews.
• Automation encouragement — The extension was partly intended to give sellers time to build automated rotation pipelines rather than relying on manual updates that are prone to human error.
• Third‑party tool impact — Vendors that provide SaaS solutions for Amazon sellers must also update the secrets embedded in their platforms, otherwise their customers may experience failed token exchanges after the deadline.