Important: You must rotate your Login With Amazon (LWA) credentials (client secrets) for all applications every 180 days
Update to LWA credential rotation deadline
On February 6, 2023, we announced that you must rotate your Login With Amazon (LWA) credentials (client secrets) for all applications every 180 days. After gathering feedback from developer partners worldwide, we have extended the deadline to rotate LWA credentials older than 180 days from March 27, 2023 to May 22, 2023.
For more information, refer to the updated announcement.
What is changing?
As of February 6, 2023, you must rotate your Login With Amazon (LWA) credentials (client secrets) for all applications every 180 days. All credentials must be rotated by March 27, 2023 May 22, 2023.
Which marketplaces are affected?
This change applies to all marketplaces.
Which applications are affected?
All SP-API applications that have credentials older than 180 days.
What action is required?
All SP-API integrations with credentials older than 180 days must rotate the credentials by March 27, 2023 May 22, 2023.
What Will Happen if Credentials aren't rotated every 180 days?
If you do not update LWA credentials before their expiry target rotation date your API integration will lose access to SP-API, including the ability to make successful API calls, which may directly impact any customers that authorize your application by restricting business critical functions. We will provide updates to all impacted developers with a notice of changes to their access 24 hours prior to implementation.
Why do I need to rotate the LWA Client Secret on my SP API application(s)?
Regular and timely rotation of LWA client credentials limits the duration of your application’s credentials in the event that credentials are exposed or compromised.
How do I rotate my LWA credentials?
Use the following procedure to generate new LWA credentials (client secrets).
- Sign in to your developer account on Seller Central, Vendor Central, or Developer Central and navigate to the Developer Console page that lists all your applications.
- From the LWA credentials column, find the expiry alert and select View.
- (Optional) For ease of reference, you can store your existing LWA credentials securely in an encrypted form.
- Choose Rotate secret, read the warning, then choose Rotate secret again.
- Repeat Steps 2 through Step 5 for every application showing an expiry alert.
Note: After you generate a new LWA credential (client secret), you must update your credentials for any applications that call the Amazon APIs. Your old credentials expire 7 days after you generate new credentials.
More information
For more information, refer to to Rotating your application's LWA credentials in the SP-API documentation.