Overview

Amazon has mandated that every Login with Amazon (LWA) integration must refresh its client secret at least once every 180 days. The final compliance date is May 22 2023, after which any app that has not performed a secret rotation will be denied authentication. Sellers who depend on LWA for linking accounts, processing checkout, or enabling voice‑driven experiences must act immediately to avoid login failures and potential security exposure.

Key Points

• 180‑day rotation rule — Each LWA client secret must be regenerated at least twice a year, no matter how often the app is used.
• May 22 2023 deadline — Applications that still rely on an older secret after this date will be blocked from authenticating with Amazon services.
• Security purpose — Regular secret changes shrink the time window a compromised credential can be abused by attackers.
• Live‑traffic risk — Swapping a secret while customers are actively logging in can generate authentication errors if the old secret remains in any code path.
• No cost to rotate — Amazon does not charge for generating new secrets; the requirement is purely for ecosystem safety.
• Per‑app enforcement — Every distinct LWA‑enabled application in a seller’s portfolio must follow the rotation schedule independently, even if multiple apps share the same developer account.

How the Rotation Process Works

1. Create a new client secret — Open the LWA entry in the Amazon Developer Console, click “Create new secret,” and copy the 32‑character string that appears. Example: A seller managing the “SmartHome” Alexa skill generates a new secret labeled “Secret‑2023‑04.”
2. Replace the secret in all environments — Update the stored value in development, staging, and production configurations, such as environment variables, Docker secrets, or CI/CD pipelines. Example: The seller updates the LWA_CLIENT_SECRET variable on their AWS Elastic Beanstalk environment and commits the change to the staging branch.