Overview

On 2 October 2023 Amazon removed the requirement for AWS Identity and Access Management (IAM) credentials and the AWS Signature Version 4 signing process from the Selling Partner API (SP‑API). From that date forward, developers authenticate exclusively with Login with Amazon (LWA) OAuth 2.0 tokens, a change that cuts integration complexity and reduces ongoing maintenance for sellers and solution providers.

Key Points

• IAM resources eliminated — Sellers no longer need to create IAM users, attach the AmazonSPAPIAccess policy, or rotate access keys for SP‑API calls.
• SigV4 signing dropped — The intricate Signature Version 4 algorithm is no longer required; a simple Bearer token in the Authorization header is sufficient.
• LWA as sole auth method — All authentication continues to rely on OAuth 2.0 access tokens issued by Login with Amazon, preserving the existing OAuth flow.
• Endpoint behavior unchanged — Every SP‑API operation, data model, and rate‑limit rule remains identical; only the authentication layer has been altered.
• Security model retained — Amazon still validates token scopes, enforces TLS, and checks token expiration, so overall security posture is not weakened.
• Automatic migration — The switch occurred on 2 October; any integration that still attempts IAM‑based authentication now receives a 401 error, prompting an immediate update.

How the New Authentication Flow Works

1. Obtain an LWA access token — Register an LWA security profile in the Amazon Developer Console, then use the profile’s client ID, client secret, and a stored refresh token to request a fresh OAuth 2.0 access token from https://api.amazon.com/auth/o2/token. Example: an inventory‑management SaaS exchanges its long‑lived refresh token for a new access token every hour to keep its API calls authorized.
2. Attach the token to the request — Insert the received access token into the HTTP header using the format . No additional headers, canonical request strings, or signed timestamps are needed.