Register for Amazon Creators API (PA-API Successor)

If you arrived here looking for Product Advertising API credentials, the most important step is not hidden in an old Associates menu: PA-API 5 has been deprecated. Amazon’s supported catalog integration is now Creators API, a REST API for publishers, influencers, and affiliate partners.

Quick registration path

1. Join Amazon Associates for the exact marketplace you intend to serve and obtain its partner/tracking tag.

1. Build a compliant, public channel and earn the qualifying referred sales required for final acceptance/API eligibility.

1. Use the primary Associates account owner to open Tools → Creators API in Associates Central.

1. Create an application with a name that maps to a real production service or environment.

1. Add a credential and immediately save its credential/client ID, secret, and assigned version in a secrets manager.

1. Download the official SDK for your server language or implement the documented OAuth client-credentials flow.

1. Request only needed catalog resources, pass the correct marketplace and partner tag, and retain vended link parameters.

1. Test authentication, throttling, caching, disclosure, link attribution, error handling, and credential rotation before production.

What changed from PA-API 5

PA-API 5 (deprecated)                 Creators API (supported)
──────────────────────────────────    ─────────────────────────────────
AWS access key + secret key           Credential/client ID + secret + version
AWS Signature Version 4 per request   OAuth 2.0 bearer access token
webservices.amazon.com/paapi5/*       creatorsapi.amazon/catalog/v1/*
PascalCase request fields              lowerCamelCase request fields
PartnerTag / Marketplace              partnerTag / marketplace + x-marketplace
Offers resources                      OffersV2 resources where applicable

Migration consequences

• Existing PA-API credentials cannot be renamed or reused; create new Creators API credentials.

• OAuth tokens are valid for one hour and should be cached/reused rather than fetched for every catalog request.

• Operation concepts remain familiar—SearchItems, GetItems, GetVariations, and GetBrowseNodes—but field casing, endpoints, authentication, and some resource models changed.

• Search the whole codebase and infrastructure for PA-API endpoints, SigV4 signing, old environment variables, PascalCase payloads, response parsing, and monitoring rules.

• Run both functional and attribution tests; a technically valid response is not enough if marketplace, partner tag, or vended link parameters are wrong.

Eligibility: do not rely on the old 3-sales rule

The legacy page quoted three qualifying sales in 180 days. Current Creators API documentation says the Associate must be enrolled for the target marketplace, finally accepted, registered for API access, and have qualifying sales; its current introduction states at least 10 qualifying sales within the past 30 days. Marketplace programs and policies can change, so the local Associates Central eligibility state and current agreement are authoritative.

• Your Associates website/channel must satisfy the local program’s content, disclosure, traffic, and policy review.

• Only the primary Associates account owner can perform Creators API signup according to the registration guide.

• The registration UI can be unavailable when the account is not finally accepted or has not generated qualifying referred sales.

• API access can later be reduced or lost when qualifying sales/activity requirements are not maintained. SiteStripe and other approved linking tools may remain alternatives.

• Eligibility in one locale does not automatically authorize another marketplace; enroll where you advertise and use that marketplace’s valid partner tag.

1. Join the correct Amazon Associates marketplace

Choose the Associates program matching the Amazon marketplace your links and API requests will target. India uses Amazon.in, the United States uses Amazon.com, and other locales have their own program sites and tags. A site can operate across locales, but each marketplace relationship, tag, policy, and API approval must be valid.

• Provide the real website/app/social channel used to send traffic; do not submit a placeholder property you do not control.

• Publish the required affiliate disclosure prominently and follow the local Operating Agreement and IP license.

• Record the primary account identity and partner/tracking tags in an access-controlled business system—not in client JavaScript.

• Do not edit or strip parameters from links returned by the API; Amazon uses them for attribution and API usage decisions.

2. Reach final acceptance and API eligibility

Associates signup and Creators API access are separate gates. Generate genuine qualifying referred sales through compliant links, monitor their shipped/qualified status in Associates Central, and wait for account review. If your business case meets the documented process but access remains unavailable, use the local Associates Help → Contact Us → Creators API path.

3. Create a Creators API application

1. Sign in to the local Associates Central site as the primary account owner.

1. Open Tools → Creators API. If absent, verify account identity, marketplace, final acceptance, and sales eligibility.

1. Choose Create Application and use a stable name such as catalog-production or editorial-tools, not a person’s laptop name.

1. Inside the application choose Add New Credential.

1. Copy or download the credential ID, credential secret, and version immediately, then move them into your approved secrets manager.

1. Record owner, service, marketplace(s), partner tag(s), creation date, rotation process, and emergency revocation contact.

Current application and credential limits

• Amazon’s registration documentation currently permits up to two applications per store.

• Each application currently supports up to two credential sets, which enables overlap during rotation.

• Delete an application only after deleting its credentials; validate that no production service still depends on them.

• Limits and screens can change, so use the live Creators API dashboard as the source of truth.

4. Treat the credential secret as production authority

Browser / mobile client
        │ requests your product endpoint
        ▼
Your server / serverless function
   ├── reads credential secret from secrets manager
   ├── obtains and caches OAuth access token (~1 hour)
   ├── rate-limits and caches policy-permitted catalog data
   └── calls Creators API with marketplace + partner tag
        │
        ▼
Sanitized response rendered to the user with compliant Amazon links

Credential handling rules

• Never place the secret or bearer token in browser JavaScript, a mobile binary, public source code, screenshots, analytics, logs, build output, support tickets, or URL query strings.

• Use a secrets manager and narrowly authorize only the runtime identity that needs the credential.

• Separate development and production applications/credentials where limits and operating processes permit.

• Rotate with overlap: deploy the second credential, verify traffic, revoke the first, and test failure alarms.

• If a secret was exposed, revoke/replace it immediately and investigate access; deleting a Git commit does not invalidate a copied credential.

5. Choose the OAuth token endpoint from credential version

• Credential version 3.1 uses the North America Login with Amazon token endpoint for US, CA, MX, and BR.

• Version 3.2 uses the Europe endpoint for marketplaces including UK, DE, FR, IT, ES, NL, BE, EG, IN, IE, PL, SA, SE, TR, and AE.

• Version 3.3 uses the Far East endpoint for JP, SG, and AU.

• The version determines token endpoint selection; request marketplace and partner-tag validity still determine the catalog locale.

• Use the exact regional endpoint table in current documentation rather than guessing from server location.

OAuth token request anatomy

{
  "grant_type": "client_credentials",
  "client_id": "YOUR_CREDENTIAL_ID",
  "client_secret": "YOUR_CREDENTIAL_SECRET",
  "scope": "creatorsapi::default"
}

Authentication takeaways

• The OAuth client-credentials grant authenticates your server application, not an Amazon shopper.

• Send this JSON only to the documented Login with Amazon token endpoint for the assigned credential version over HTTPS.

• A successful response contains an access token, bearer token type, scope, and expires_in value—currently 3600 seconds.

• Cache the token until shortly before expiry and share the cache across processes using the same credential; fetching per API call can throttle the token endpoint.

• Do not log the request body or full token response. Prefer the official SDK, which handles token caching and renewal.

Catalog request anatomy

{
  "itemIds": ["B000000000"],
  "itemIdType": "ASIN",
  "marketplace": "www.amazon.in",
  "partnerTag": "YOUR_INDIA_PARTNER_TAG",
  "resources": [
    "images.primary.medium",
    "itemInfo.title",
    "offersV2.listings.price"
  ]
}

Request takeaways

• POST the payload to the documented operation endpoint, such as https://creatorsapi.amazon/catalog/v1/getItems.

• Send Authorization: Bearer <access_token>, Content-Type: application/json, and an x-marketplace header matching the body marketplace.

• Request only the resources the page uses; smaller responses reduce processing and cache complexity.

• B000000000 and the partner tag are placeholders. An ASIN may not exist or be accessible in every marketplace.

• Use the detail-page URLs returned by Amazon and preserve their parameters rather than constructing or rewriting attribution links.

Make a first authorized request with cURL

$ curl -sS -X POST 'https://creatorsapi.amazon/catalog/v1/getItems' \
  -H "Authorization: Bearer $CREATORS_ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'x-marketplace: www.amazon.in' \
  --data-binary @get-items-request.json

Run this only in a protected environment

• CREATORS_ACCESS_TOKEN must already contain a valid token; keep shell history, process inspection, CI masking, debugging proxies, and command tracing from exposing it.

• The request file must contain the correct India partner tag and a real ASIN; do not commit credentials or private test data.

• -sS suppresses progress while retaining transfer errors. Parse the HTTP status and JSON error reason in application code rather than treating any JSON as success.

• cURL is useful for controlled diagnosis; Amazon recommends the official SDK for token lifecycle, serialization, and error handling.

• This request consumes API quota and sends authorized traffic to Amazon. Use a test ASIN and the minimum resource set.

Rate limits and continued access

• Creators API currently grants newly created credentials an initial limit up to 1 transaction per second and 8,640 transactions per day for the first 30 days; the account dashboard and responses remain authoritative.

• Allocations are adjusted from shipped item revenue attributed to API-generated links, and access can be lost after a consecutive 30-day period without qualified referring sales.

• A 429 response can mean per-second/daily throttling, lost access, or excessive token requests. Inspect the endpoint and documented error reason.

• Use bounded exponential backoff with jitter and respect Retry-After; do not retry invalid credentials or ineligibility as if they were transient.

• Cache one-hour OAuth tokens and distribute catalog calls over time; web crawlers should not cause an API call for every page view.

Cache only within the license

• Current best-practices guidance allows Offers and BrowseNodeInfo data for one hour, and other listed catalog resources such as images/item info for one day, subject to the license.

• Do not cache customer information derived from Amazon; the terms prohibit it.

• Store expiration per resource because one response can contain fields with different allowed lifetimes.

• On cache miss, request only missing/expired resources; on expiry, refresh or stop displaying stale fields according to policy.

• Re-read the Creators API license and local Associates agreement before implementing storage, price display, images, reviews, link formatting, or offline/export features.

Production error handling

• 401 InvalidToken / TokenExpired: validate endpoint/version, credential, token cache and expiry; refresh once, then fail safely.

• 403 AssociateNotEligible: check final acceptance, qualifying sales, primary account, locale enrollment, tag, and API dashboard; contact Associates support rather than looping requests.

• 403 PA-API deprecated: a code path still calls webservices.amazon.com/paapi5; migrate that path and old credentials.

• 404 item unavailable: ASIN can be invalid, removed, or unavailable in the selected marketplace. Remove/degrade the card rather than fabricating data.

• 429 throttled: obey rate headers/backoff, reuse tokens, deduplicate requests, add cache/single-flight behavior, and monitor TPS/TPD.

• 500 service error: retry a limited number of idempotent reads with backoff/jitter and preserve a user-safe fallback.

Migration checklist for PA-API 5 applications

1. Inventory every PA-API endpoint, credential, signer, SDK, Lambda/job, cache, parser, test, dashboard, and generated link.

1. Register Creators API applications and credentials in each required Associates marketplace/region.

1. Replace SigV4 with OAuth token management or an official Creators API SDK.

1. Change endpoints, PascalCase payload fields, resource names such as OffersV2, headers, and error parsing.

1. Keep the correct partner tag and marketplace in every request and preserve all parameters in vended links.

1. Apply documented per-resource caching, rate limiting, token sharing, credential rotation, and secret redaction.

1. Run shadow/contract tests with real eligible accounts, then cut traffic and monitor attribution, 401/403/429/5xx, latency, cache freshness, and link correctness.

1. Revoke old credentials and remove PA-API code only after proving no production caller remains.

Related affiliate and API guides

• Start with creating an Amazon Associates account.

• Protect application credentials using environment variables and secret management.

• Design reliable backoff using HTTP status codes and API error handling.

Primary references

• Amazon’s PA-API 5 deprecation notice identifies Creators API as the supported replacement.

• The official Creators API registration guide documents acceptance, primary-owner signup, applications, and credentials.

• Amazon’s Creators API introduction lists current eligibility and catalog operations.

• The cURL guide documents OAuth endpoints, token requests, headers, and operation endpoints.

• The programming practices and API rates pages define token reuse, attribution, caching, and limits.