# Sponsored Ads setup for PopMCP You end up pasting the Client ID and Client Secret of a Login with Amazon security profile that Amazon has approved for the Ads API, read from the profile's Web Settings at developer.amazon.com. Then you sign in and pick the ad account from a list. - Auth: OAuth authorization - Setup time: 20 min of forms, then up to 1 business day of Amazon review - API base URL: https://advertising-api.amazon.com (North America), https://advertising-api-eu.amazon.com (Europe), https://advertising-api-fe.amazon.com (Far East) - Credentials screen: https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html - Provider docs: https://advertising.amazon.com/API/docs/en-us/guides/onboarding/overview ## Approval required before this works Amazon must approve a Login with Amazon security profile for the Ads API before it can call anything. There are no API keys and no personal tokens. A direct advertiser and a partner apply through different forms, and the approval is then assigned to one security profile. - Typical wait: Amazon says review "may take up to 1 business day". You get an email at the address you applied with. - Cost: Amazon charges nothing to apply or to call the API. You pay for your ads as usual. - Blocked until approved: Everything. Without the approval, sign-in works but every Ads API call is refused, and PopMCP says so. The approval also covers only that one security profile. - Works meanwhile: Create the security profile and add PopMCP's callback URL to Allowed Return URLs, so you are ready when the email arrives. An approved app can also create test accounts, with a separate Amazon user made for testing. ## Before you begin - An Amazon Developer account at developer.amazon.com. Use an email your company shares: Amazon says the link between the login and your Ads API access cannot be changed once it is set - An Amazon user with View and Edit access to the advertising accounts you want to connect - A public privacy policy URL for the security profile - A new Login with Amazon security profile. Amazon says to create a new one even if you already have one for the Selling Partner API - Amazon's approval for the Ads API. Amazon says review may take up to 1 business day ## Get your credentials ### 1. Create a Login with Amazon security profile Sign in at developer.amazon.com, open Developer Console, then Login with Amazon on the menu bar. Click Create a New Security Profile, fill in Security Profile Name, Security Profile Description and Consent Privacy Notice URL, and click Save. Screen: https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html ### 2. Apply for Ads API access A direct advertiser opens advertising.amazon.com/about-api, selects Request API Access, and chooses Direct Advertiser. An agency or tool provider applies from the Amazon Ads Partner Network, under API Applications. Sign in with the same email as the developer account, complete the form and select Submit for review. Screen: https://advertising.amazon.com/about-api ### 3. Assign the access to your security profile Log out of every other Amazon account first, then open the link in Amazon's approval email. Click Continue, select the security profile from step 1, and click Submit. The next page shows your client ID and the scopes it can use. ### 4. Add PopMCP's return URL and copy your credentials Back in Login with Amazon, hover over the gear under Manage for your profile and select Web Settings. Click Edit, paste the callback URL from PopMCP's connect form into Allowed Return URLs, and click Save. Then, in the Login with Amazon list, click Show Client ID and Client Secret and copy both into PopMCP. Screen: https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html ### 5. Sign in and pick your ad account In PopMCP paste Client ID and Client secret, and set Amazon region if your account is outside North America (EU or FE). Click Sign in with Amazon, sign in with the user who manages your ads, and click Allow. PopMCP then lists the accounts that user can reach, in every region. Pick one. ## Fields PopMCP asks for - Amazon region (region): NA for the US, Canada, Mexico, Brazil. EU for Europe, the Middle East, India, South Africa. FE for Japan, Australia, Singapore. Leave empty for North America. This is the Amazon site you sign in to. - Client ID (clientId) [required]: From your Login with Amazon security profile, on a profile Amazon has approved for the Ads API. - Client secret (clientSecret) [required]: From the same security profile. Stored encrypted and used only on the server. - Extra scopes (extraScopes): Almost nobody needs this. advertising::test:create_account is for a user made only for test accounts. advertising::audiences is for approved data providers. ## Callback URL to register https://app.popmcp.com/api/providers/amazon-ads/callback ## Scopes requested - advertising::campaign_management ## Verify PopMCP shows Amazon Ads as Connected with your account name and marketplace, for example Acme Supply (US). Ask your AI to run amazon_ads_run_report for the last 7 days: rows come back per campaign. ## Troubleshooting ### The Amazon page says the redirect URI is not allowed Cause: PopMCP's callback URL is not in Allowed Return URLs on the security profile, or differs by a character. Fix: Open Web Settings, choose Edit, and paste the exact URL shown on PopMCP's connect form. ### PopMCP says Amazon refused the Ads API for this app Cause: Amazon has not approved the application, or the access was assigned to a different security profile. Fix: Finish steps 2 and 3, and make sure the Client ID in PopMCP belongs to the profile you assigned the access to. ### PopMCP says this Amazon user has no advertising account Cause: The user has no View and Edit access to an ad account, or signed in on the wrong regional Amazon site. Fix: Sign in with the user who manages your ads. If your account is in Europe or the Far East, set Amazon region to EU or FE and connect again. ### A connection that worked stops, and PopMCP asks you to reconnect Cause: Amazon ends authorizations 365 days after consent, for those given since July 30, 2026, and when the user revokes access. Fix: Connect Amazon Ads again and choose Allow. ### An Amazon DSP call answers 403 Cause: The connected account has no Amazon DSP advertiser, or Amazon has not opened that endpoint to your app. Fix: Connect the Amazon DSP advertiser from the account list. Closed beta endpoints need Amazon's approval first. --- Source: https://www.docs.popmcp.com/docs/integrations/sponsored-ads-api/