Log inGet started

Front Amazon SP-API

When to use this

Amazon Selling Partner API enforces a shared concurrency limit per application. Teams often hit credential sprawl with Login with Amazon (LWA): one credential per caller, or one developer app per caller. Pin a regional SP-API host, store one refresh token as a managed credential, and hand each caller a short-lived access key.

Sellers can authorize your app through Connect (Amazon's website authorization workflow), or you can paste a refresh token you already have from self-authorization. Restricted Data Tokens are out of scope.

Origins to pin

Pick the regional host your app already calls:

Host Region
https://sellingpartnerapi-na.amazon.com North America
https://sellingpartnerapi-eu.amazon.com Europe
https://sellingpartnerapi-fe.amazon.com Far East

One source, one region. Put multiple hosts on one source only when those hosts must share the same concurrency budget.

Setup

  1. Create a source and pin the SP-API origin under Settings.
  2. On Credentials, add an OAuth 2.0 refresh token credential:
    • Connect → provider Amazon Selling Partner API. Pick the Seller Central store, enter your SP-API application ID and the LWA client ID and secret, and check Draft while the app is unpublished. Register the redirect URI the form shows as an OAuth redirect URI on the app. Save and connect sends you to Seller Central; after the seller approves, swarmvia holds the refresh token and the row shows which selling_partner_id authorized it.
    • Paste a refresh token → LWA client id, client secret, and refresh token, token URL https://api.amazon.com/auth/o2/token, access-token header x-amz-access-token.
  3. On the source's Settings, choose Managed custody and OAuth 2.0 refresh token, then attach that credential.
  4. Set Max concurrency to your safe Amazon limit (or use Adaptive with that value as the max).
  5. Give each caller a Control API token so it mints its own access keys (sv_at_…) and refreshes them before they expire. See Refresh access tokens before they expire. For a quick curl check, use Access → Create test key.
  6. Point callers at https://‹source›.swarmvia.cloud/... instead of the Amazon host. Send X-Swarmvia-Key.
curl -sS "https://sp-na.swarmvia.cloud/orders/v0/orders?MarketplaceIds=ATVPDKIKX0DER" \
  -H "X-Swarmvia-Key: $ACCESS_KEY" \
  -H "Accept: application/json"

swarmvia exchanges the refresh token, caches the access token, and sends x-amz-access-token. When the pinned origin is a sellingpartnerapi-*.amazon.com host it also sends x-amz-date and, if the caller omitted User-Agent, swarmvia. Callers never see the LWA secret or refresh token.

Tips

  • One Amazon developer app can serve many access keys. Rotate the credential when you rotate the LWA secret; callers' access keys are not affected.
  • If a seller revokes the app, calls fail with 424 credential_needs_reauthorization. The reconnect_url in that error starts Connect again for a Connect credential.
  • Enable Retry on 429 so transient Amazon throttles are absorbed at the edge.
  • SigV4/IAM is not required for SP-API seller calls.

See also