Sponsored Ads
Connect Sponsored Ads to Claude, ChatGPT and other MCP clients with PopMCP. Covers developer account approval, the OAuth app and common errors.
You end up pasting the Client ID and Client Secret of a Login with Amazon security profile that Amazon has approved for the Ads API, read from the profile's Web Settings at developer.amazon.com. Then you sign in and pick the ad account from a list.
Developer account approval before this connector works
Amazon must approve a Login with Amazon security profile for the Ads API before it can call anything. There are no API keys and no personal tokens. A direct advertiser and a partner apply through different forms, and the approval is then assigned to one security profile.
- Typical wait
- Amazon says review "may take up to 1 business day". You get an email at the address you applied with.
- Cost
- Amazon charges nothing to apply or to call the API. You pay for your ads as usual.
- Blocked until approved
- Everything. Without the approval, sign-in works but every Ads API call is refused, and PopMCP says so. The approval also covers only that one security profile.
- Works meanwhile
- Create the security profile and add PopMCP's callback URL to Allowed Return URLs, so you are ready when the email arrives. An approved app can also create test accounts, with a separate Amazon user made for testing.
Where to apply: Direct advertisers: advertising.amazon.com/about-api, Request API Access, Direct Advertiser. Agencies and tool providers: Amazon Ads Partner Network, API Applications, Request API Access, then the Advertising API tab. Complete the form and Submit for review. When approved, follow the link in the email and assign the access to your security profile.
- Log out of every other Amazon account before opening the link in the approval email. Amazon warns that opening it while signed in to the wrong account invalidates it, and its support team has to reset it.
- Apply with the same email as the developer account that owns the security profile. Amazon says the association "cannot be changed once it is set", so use an address your company shares.
- Create a new security profile even if you have one for the Selling Partner API. Amazon says the existing one cannot be reused.
- Amazon's policy is one client ID per company. Any number of users in the company can use it.
- Closed beta endpoints need Amazon to add your app to that program as well, on top of this approval.
- Setup time
- 20 min of forms, then up to 1 business day of Amazon review
- Auth
- OAuth authorization
- API base URL
- https://advertising-api.amazon.com (North America), https://advertising-api-eu.amazon.com (Europe), https://advertising-api-fe.amazon.com (Far East)
- Rate limits
- Amazon publishes no fixed numbers: limits change with its load. A throttled call answers 429 with a Retry-After header. Report creation has lower limits when the report queue is long, as low as one report at a time per client ID.
Before you begin
- An Amazon Developer account at developer.amazon.com. Use an email your company shares: Amazon says the link between the login and your Ads API access cannot be changed once it is set
- An Amazon user with View and Edit access to the advertising accounts you want to connect
- A public privacy policy URL for the security profile
- A new Login with Amazon security profile. Amazon says to create a new one even if you already have one for the Selling Partner API
- Amazon's approval for the Ads API. Amazon says review may take up to 1 business day
Get your credentials
Create a Login with Amazon security profile
Sign in at developer.amazon.com, open Developer Console, then Login with Amazon on the menu bar. Click Create a New Security Profile, fill in Security Profile Name, Security Profile Description and Consent Privacy Notice URL, and click Save.
Security Profile Management
Create a new security profile for the Ads API.
Apply for Ads API access
A direct advertiser opens advertising.amazon.com/about-api, selects Request API Access, and chooses Direct Advertiser. An agency or tool provider applies from the Amazon Ads Partner Network, under API Applications. Sign in with the same email as the developer account, complete the form and select Submit for review.
Request API access
You will get an email once the application is reviewed.
Amazon says review may take up to 1 business day.
Assign the access to your security profile
Log out of every other Amazon account first, then open the link in Amazon's approval email. Click Continue, select the security profile from step 1, and click Submit. The next page shows your client ID and the scopes it can use.
Assign API access
Choose the Login with Amazon application for this access.
| Application | Client ID |
|---|---|
| PopMCP Ads Connector | amzn1.application-oa2-client.8f2c**** |
Add PopMCP's return URL and copy your credentials
Back in Login with Amazon, hover over the gear under Manage for your profile and select Web Settings. Click Edit, paste the callback URL from PopMCP's connect form into Allowed Return URLs, and click Save. Then, in the Login with Amazon list, click Show Client ID and Client Secret and copy both into PopMCP.
PopMCP Ads Connector
Web Settings
- Client ID
- amzn1.application-oa2-client.8f2c****
- Client Secret
- amzn1.oa2-cs.v1.a1b2****
Sign in and pick your ad account
In PopMCP paste Client ID and Client secret, and set Amazon region if your account is outside North America (EU or FE). Click Sign in with Amazon, sign in with the user who manages your ads, and click Allow. PopMCP then lists the accounts that user can reach, in every region. Pick one.
PopMCP Ads Connector would like to access
Sign in with the Amazon user who manages your ads.
Advertising campaign management: view and change your advertising data.
Connect in PopMCP
Open your workspace, choose Sponsored Ads in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Amazon regiontext | NA for the US, Canada, Mexico, Brazil. EU for Europe, the Middle East, India, South Africa. FE for Japan, Australia, Singapore. Leave empty for North America. This is the Amazon site you sign in to. |
| Client IDtext | From your Login with Amazon security profile, on a profile Amazon has approved for the Ads API. |
| Client secretsecret | From the same security profile. Stored encrypted and used only on the server.Encrypted with AES-256-GCM on save and never shown again. |
| Extra scopestext | Almost nobody needs this. advertising::test:create_account is for a user made only for test accounts. advertising::audiences is for approved data providers. |
https://app.popmcp.com/api/providers/amazon-ads/callbackOnly for your own app: on your Login with Amazon security profile open Web Settings, choose Edit, and paste this exact URL under Allowed Return URLs.
PopMCP verifies the credential against Sponsored Ads immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Sponsored Ads at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| advertising::campaign_management | The one scope PopMCP asks for. It covers reading and changing campaigns, reports and account data for Sponsored Products, Sponsored Brands, Sponsored Display, Sponsored TV and Amazon DSP. |
Verify it worked
PopMCP shows Amazon Ads as Connected with your account name and marketplace, for example Acme Supply (US). Ask your AI to run amazon_ads_run_report for the last 7 days: rows come back per campaign.
Troubleshooting
The Amazon page says the redirect URI is not allowed
Why: PopMCP's callback URL is not in Allowed Return URLs on the security profile, or differs by a character.
Fix: Open Web Settings, choose Edit, and paste the exact URL shown on PopMCP's connect form.
PopMCP says Amazon refused the Ads API for this app
Why: Amazon has not approved the application, or the access was assigned to a different security profile.
Fix: Finish steps 2 and 3, and make sure the Client ID in PopMCP belongs to the profile you assigned the access to.
PopMCP says this Amazon user has no advertising account
Why: The user has no View and Edit access to an ad account, or signed in on the wrong regional Amazon site.
Fix: Sign in with the user who manages your ads. If your account is in Europe or the Far East, set Amazon region to EU or FE and connect again.
A connection that worked stops, and PopMCP asks you to reconnect
Why: Amazon ends authorizations 365 days after consent, for those given since July 30, 2026, and when the user revokes access.
Fix: Connect Amazon Ads again and choose Allow.
An Amazon DSP call answers 403
Why: The connected account has no Amazon DSP advertiser, or Amazon has not opened that endpoint to your app.
Fix: Connect the Amazon DSP advertiser from the account list. Closed beta endpoints need Amazon's approval first.
Reference
- Sponsored Ads API documentation
- Sponsored Ads credentials screen
- Connect an AI client
- Access modes and tool catalogs
Amazon, Amazon Ads and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates. PopMCP is an independent product that connects to the Amazon Ads API. It is not made, endorsed or sponsored by Amazon.