# Selling Partner setup for PopMCP You end up with three values from your own SP-API app client in Seller Central. The LWA Client ID (amzn1.application-oa2-client.…), the LWA Client Secret (amzn1.oa2-cs.v1.…) and a self-authorization refresh token (Atzr|…), plus your region and optionally your Merchant Token. - Auth: API credentials - Setup time: 30 min - API base URL: https://sellingpartnerapi-na.amazon.com - Credentials screen: https://sellercentral.amazon.com/sellingpartner/developerconsole - Provider docs: https://developer-docs.amazon.com/sp-api/docs/connecting-to-the-selling-partner-api ## Approval required before this works Amazon must approve your SP-API developer profile before Login with Amazon credentials return live Selling Partner data. Roles Amazon marks Restricted carry an extra review of your data use and security controls, including an architecture review. - Typical wait: Amazon's only published figure is for service-provider registration and role approval: "processing can take up to 10 business days". Amazon does not publish a review time for the developer profile itself; developer-community reports commonly describe a few business days, sometimes stretching to several weeks. Treat anything beyond the 10-business-day figure as unofficial. - Cost: Amazon charges nothing for developer registration, SP-API application registration, or API calls. Note for context: an annual SP-API subscription fee plus a per-GET-call overage was announced in November 2025, postponed twice, and then reported as withdrawn in May 2026. Amazon has not published a standing fee schedule, and the withdrawal is documented in third-party reporting citing Amazon partner emails rather than on an Amazon page - so do not quote a dollar amount to users as current Amazon policy. - Blocked until approved: Everything against production: you cannot register a production SP-API application, cannot obtain a usable LWA client ID/secret for live data, and sellers cannot authorise you (the role checkboxes stay unavailable in Seller Central). Separately, the roles Amazon designates Restricted - Direct-to-Consumer Shipping (Restricted), Professional Services (Restricted), Tax Invoicing (Restricted), and Tax Remittance (Restricted) - stay locked until the additional data-use and security review passes, so any call needing the buyer PII those roles carry returns an authorisation error even after basic approval. - Works meanwhile: Build against the SP-API sandbox. Static, dynamic, and AI sandbox environments return mock or realistic responses without live seller data, so the API models, request signing, and SDK/auth plumbing can all be finished and tested first. Amazon does not explicitly frame the sandbox as a during-review activity and application registration still requires a primary account user, so confirm what your account can create before planning around it. ## Before you begin - A Professional selling account on Seller Central. Individual accounts cannot register for SP-API. - Sign in as the Primary User of the Seller Central account. Only the Primary User sees the Authorize option. - A completed developer registration. Amazon reviews the developer profile and commonly takes a few business days. - Register as a private developer if the app only ever talks to your own seller account. Public Appstore apps need a separate listing and review. ## Get your credentials ### 1. Open Developer Central Sign in to Seller Central and choose Apps and Services, then Develop Apps. If you have never registered, complete the developer profile and pick private developer. Screen: https://sellercentral.amazon.com/sellingpartner/developerconsole ### 2. Add a new app client Click Add new app client, name it `PopMCP`, choose SP API from the API Type list and tick Sellers. Select the roles your tools need, then leave OAuth Login URI and OAuth Redirect URI blank and click Save and exit. Screen: https://sellercentral.amazon.com/sellingpartner/developerconsole ### 3. Copy the LWA Client ID and Client Secret Find your app on the Developer Central page, choose Edit app, then click View under LWA credentials. Copy Client identifier into PopMCP's LWA Client ID and Client secret into LWA Client Secret. Screen: https://sellercentral.amazon.com/sellingpartner/developerconsole ### 4. Authorize the app to mint a refresh token Open the arrow next to Edit app and choose Authorize. On the Authorize application page click Authorize app for your seller account, then copy the `Atzr|` token into PopMCP's Refresh token. Screen: https://sellercentral.amazon.com/sellingpartner/developerconsole ### 5. Set Region and, optionally, the Merchant Token Set Region to `na`, `eu` or `fe` to match your marketplace, and leave Environment on production. For Selling Partner ID, open the Settings menu at the top right of Seller Central, go to Account Info, then Merchant Token, and copy that value. Screen: https://sellercentral.amazon.com/sw/AccountInfo/MerchantToken/step/MerchantToken ## Fields PopMCP asks for - Auth type (connectionType): SP-API uses Login with Amazon. We only ever store your LWA Client ID / Secret and refresh token (encrypted) and mint short-lived access tokens from them server-side. No AWS IAM or SigV4 signing is required. - LWA Client ID (lwaClientId) [required]: From your SP-API app: Seller Central → Develop Apps → your app → 'LWA credentials' → Client ID. - LWA Client Secret (lwaClientSecret) [required]: The secret paired with your LWA Client ID (same 'LWA credentials' panel). Stored encrypted; used only server-side to mint access tokens. - Refresh token (refreshToken) [required]: Generate it by clicking 'Authorize' on your app in Seller Central (self-authorization). Starts with 'Atzr|'. It is long-lived and does not expire on use. - Region (region): na - Selling Partner ID (optional) (sellingPartnerId): Your Merchant / Seller ID (Seller Central → Settings → Account Info → Merchant Token). Optional, but if provided it's auto-filled into the Listings API so you don't have to pass it each call. - Environment (optional) (environment): production ## Verify PopMCP's Amazon Selling Partner connector shows Connected, and a request such as "list recent orders" returns real order IDs from your seller account in the region you selected. ## Troubleshooting ### 401 Unauthorized from the LWA token endpoint Cause: The Client ID or Client Secret does not match, or the refresh token came from a different app client. Fix: Re-copy all three values from the same app in Developer Central. A refresh token is only valid for the app client that issued it. ### 403 Unauthorized, access to requested resource is denied Cause: The app is missing the role that covers that API, or the refresh token was minted before you added the role. Fix: Edit the app to add the role, save, then run Authorize again to get a fresh refresh token. ### No Authorize option next to Edit app Cause: You are signed in as a secondary user, or the developer profile is still under review. Fix: Sign in as the account's Primary User and wait until developer registration is approved. ### You lost the refresh token Cause: Amazon shows the token on the Authorize application page and does not keep it in a credentials panel. Fix: Click Authorize app again to issue a new one. Existing tokens are not invalidated by this. ### Calls return 400 or empty results for your marketplace Cause: Wrong region. An EU marketplace queried against the na endpoint returns nothing. Fix: Set Region to na, eu or fe to match the marketplace and reconnect. ### 429 QuotaExceeded Cause: SP-API throttles per operation with its own rate and burst budget. Fix: Slow the calls down and retry with backoff. The budget refills continuously and differs per endpoint. --- Source: https://www.docs.popmcp.com/docs/integrations/selling-partner-api/