Access and authorisation
Every SP-API application is registered in a developer profile and requests roles, such as Inventory and Order Tracking or Pricing. The roles decide which operations you can call. Roles that expose buyer personal data, such as shipping addresses, are restricted and need extra approval.
Sellers and vendors grant your application access through Login with Amazon (LWA). You store a refresh token per account and exchange it for short-lived access tokens. Treat refresh tokens like passwords: encrypt them and keep them out of logs.
Rate limits shape the architecture
Each operation has its own usage plan: a steady rate and a burst allowance. Exceed it and Amazon returns HTTP 429. Some operations also adjust limits per selling partner, and the response headers tell you the current rate.
- Put every call behind a queue with a limiter per account and per operation.
- Retry 429 and 5xx responses with exponential back-off and jitter, never in a tight loop.
- Make writes idempotent, so a retried feed or update cannot apply twice.
Reports, feeds and live calls
Not every question needs a live API call. The Reports API produces bulk files (for example all listings, settlements or FBA inventory) asynchronously: you request a report, wait until it is done, then download the document. The Feeds and Listings Items APIs handle bulk and single-item writes.
A good rule: reports for history and bulk, live calls for the handful of things that must be current to the minute, such as a single order before you ship it.
Notifications instead of polling
The Notifications API pushes events such as order status changes, pricing changes and report completion to an Amazon SQS queue or Amazon EventBridge. Subscribing removes most polling, saves rate limit for the calls that need it, and makes the integration react faster.
Personal data and compliance
Amazon’s Data Protection Policy and Acceptable Use Policy apply to every integration. Buyer personal data is returned only with a restricted data token for the specific operation, may be kept only as long as needed (typically for fulfilment and tax), and must be encrypted at rest.
Running it in production
Log every request with its operation, account and Amazon request ID. Alert on rising 429 rates, failed reports and queues that stop draining. Watch the SP-API deprecation schedule: Amazon retires older API versions on announced dates, and missing one breaks the integration on that day.
Amazon has also introduced fees for third-party SP-API developers. Check the current terms in the developer documentation before you plan costs.