Overview

Amazon has removed the ability for developers to pull personally identifiable information (PII) from the Selling Partner API (SP‑API) using Login with Amazon (LWA) access tokens. The change, announced in an updated “Discontinued Support” notice, takes effect immediately. Sellers and developers who rely on SP‑API to retrieve buyer data must adjust their integrations to use the new authorization flow.

Key Points

• LWA tokens no longer return PII — Any SP‑API request authenticated with an LWA token will now omit buyer name, address, email, and phone fields from the response.
• All LWA‑authenticated calls are affected — Order, shipment, and buyer‑information endpoints that previously returned full details will now provide only non‑PII data.
• New “SP‑API Authorization” flow is required — Developers must switch to the OAuth flow that issues a separate access token with the “read:buyer_info” scope.
• Endpoints still exist but need new token — GetBuyerInfo and GetOrderBuyerInfo remain operational but will reject requests lacking the required scope.
• Immediate enforcement — The policy is in effect from the moment of the announcement; no grace period is provided.
• Explicit buyer consent is mandatory — The new token can only be issued after the buyer approves the “read:buyer_info” permission during the authorization step.
• Scope validation happens at token issuance — Tokens issued without the required scope will trigger a 403 Forbidden status or silent removal of PII fields.
• Sandbox testing is now essential — Developers must verify the new flow in the SP‑API sandbox before deploying to production.
• Legacy integrations will fail silently — Calls that still use the old LWA token will return incomplete data, potentially breaking downstream processes.
• Compliance is tied to Amazon’s policy — Failure to update integrations can result in API access restrictions or account suspension.