Skip to main content

2025-02 Amazon Pay Credential Changes

Due to a deprecation of a underlying API used to access Amazon Pay reports, the way users authenticate with Amazon Pay must be changed. New Amazon Pay merchants and merchants that had a account restructuring in the recent past are now unable to generate the old credentials.

The authentication changes from the current Merchant ID / Auth Token pair to a public key / API key pair. To implement the new authentication, two new account fields have been added and the old ones were marked as deprecated (see Amazon Pay Account Fields).

warning

If you’re not using our Account UI, you must update your requests that create or update Amazon Pay accounts, see API Requests.

Unfortunately, existing credentials cannot be migrated to the new authentication automatically. Although announced, Amazon doesn't yet provide a migration path. The API keys must therefore be created manually for all existing accounts.

Please inform your users about this change. According to our current knowledge, the old credentials should work until March 2026.

API Key Creation​

The following steps are necessary to create a new API key.

  1. Log into the Amazon Pay Seller central.
  2. Click on the menu in the top-left corner and navigate to "Integration" → "Integration Central"
  3. Select "New Solution Provider" under "Anleitungen, Schlüssel und IDs zur Verknüpfung Ihres Shops" and click on "Anleitungen anzeigen"
  4. Look for the button "Schlüssel erstellen" and click on it.
  5. Enter "PayData" (or something else) as the name and click on "Schlüssel erstellen".
  6. The file with the API key is automatically downloaded, the "Public Key-ID" can be copied from the "Integration Central" page.

API Requests​

You can change the authentication of an existing account by setting the new account fields public-key-id and api-key. If set, these fields take precedence over the old fields.

  • public-key-id: The "Public Key-ID" from the Amazon Pay Integration central.
  • api-key: The contents of the .pem file that was downloaded during the API key creation. Base64 encoded or as plain text.
RequestOld RequestNew Request
Account Creation
{
  "accountTypeId": "amazon_payments",
  "name": "Amazon Pay",
  "accountFields": {
    "merchant-id": "A1Q....",
    "mws-auth-token": "amzn.mws...",
    "start-date": "2025-01-01"
  }
}
{
  "accountTypeId": "amazon_payments",
  "name": "Amazon Pay",
  "accountFields": {
    "public-key-id": "LIVE-....",
    "api-key": "-----BEGIN PRIVATE KEY-----\n ... \n-----END PRIVATE KEY-----",
    "start-date": "2025-01-01"
  }
}
Account Update
{
  "accountFields": {
    "merchant-id": "A1Q....",
    "mws-auth-token": "amzn.mws..."
  }
}
{
  "accountFields": {
    "public-key-id": "LIVE-....",
    "api-key": "-----BEGIN PRIVATE KEY-----\n ... \n-----END PRIVATE KEY-----"
  }
}

Warnings​

Amazon Pay accounts that still use the deprecated credentials will have a warning that the credentials should be updated.

{
    "id": "abc123",
    "accountTypeId": "amazon_payments",
    "name": "AmazonPay",
    "status": "Idle",
    "elementStatistics": { "count": 0, "first": null, "last": null },
    "accountFields": {
        "public-key-id": "",
        "api-key": "",
        "merchant-id": "A1...",
        "start-date": "2025-01-08T23:00:00.0000000Z"
    },
    "errors": [],
    "warnings": [
        {
            "type": "CredentialsDeprecation",
            "message": "Please update the Amazon Pay credentials to use API keys. See account setup help for more details.",
            "providerMessage": null,
            "isUserActionRequired": true,
            "isTemporary": false
        }
    ]
}

Testing​

Authentication with LIVE and SANDBOX Amazon Pay API keys can be tested in the PayData sandbox. The PayData sandbox is limited to Amazon Pay sandbox settlement reports but this does not affect the authentication.