Rotating, renewing, refreshing, changing and updating your Amazon client secret all mean the same thing here. People also call these "Amazon keys", "Amazon API keys", "SP-API credentials" or "the Amazon secret". Whichever you call it, this page is the one you want.
Why does my Amazon client secret expire?
Amazon requires the Login with Amazon (LWA) client secret for every Selling Partner API application to be replaced every 180 days. This is Amazon's rule, not ours, and it applies whether or not you are actively selling. There is nothing you can do to switch it off or extend it.
It matters because an expired secret does not fail gently. The moment it lapses, Amazon refuses to issue the access tokens that Flow needs, and everything Amazon stops at once:
- new Amazon orders stop being imported,
- your stock levels stop being sent to Amazon, so Amazon keeps showing whatever number it had last,
- the Amazon connection shows an error, and validating it fails.
Nothing is lost or corrupted — it all resumes once you put a new secret in — but until you do, you can oversell, because Amazon is still selling from a stock number that is no longer being updated.
How much warning do I get before my Amazon secret expires?
You get warned twice, from two different places:
- Amazon warns you about 30 days ahead. You will see an "Action Required: Rotate LWA Credentials" banner when you sign in to Seller Central, and Amazon may email you.
- Flow warns you 20 days ahead, but only if the expiry date has been entered. A banner appears across the top of your dashboard and stays there — it cannot be dismissed — and it turns red once the date has passed.
The expiry date has to be typed in once, because no Amazon API will tell us when your secret expires. Amazon only shows that date inside its own developer portal. That is why the date is part of the form when you paste a new secret: entering it is what arms the reminder for next time.
Where do I find my Amazon client secret to renew it?
You do this in Amazon's own developer portal, not in Flow.
- Sign in to Amazon Seller Central.
- Go to Apps and Services → Develop Apps (Amazon also calls this the Solution Provider Portal). You will see a list of your applications.
- Find the application you use to connect to Flow. If Amazon has flagged it, there is a warning triangle next to it in the LWA credentials column.
!Amazon's Develop Apps list. One application row is shown with its name and ID hidden; the View link in the LWA credentials column is highlighted. Other applications are blurred out.
The long ID under the app name is NOT the Client ID
This catches people out, so it is worth being explicit.
The identifier printed under the application's name in that list — the one beginning amzn1.sp.solution. — is the App ID. It is *not* the credential Flow asks for, and pasting it into Flow will not work.
You must click "View" in the LWA credentials column. That opens a panel showing the real Client identifier, which begins amzn1.application-oa2-client. — and that is the value Flow calls the LWA Client ID.
!The LWA credentials panel opened from the View link. It shows the Client identifier beginning amzn1.application-oa2-client with the rest hidden, a Client secret section, and the Rotation Deadline date highlighted.
The same panel shows your Rotation Deadline — the exact date and time your current secret stops working. Make a note of it; you will type it into Flow in a moment.
How do I generate a new Amazon client secret?
In that same LWA credentials panel, choose the option to generate or rotate the client secret. Amazon shows you the new secret once. Copy it straight away — if you close the panel without copying it, you will have to generate another one.
Your old secret keeps working until its deadline. Generating the new one does not switch anything off, so there is no rush between generating it and pasting it into Flow, and no moment where your store is broken. If something goes wrong you are still trading on the old secret.
Will I have to reconnect Amazon or sign in again after changing the secret?
No. Changing the client secret does not disconnect anything and does not invalidate the authorisation you gave Flow when you first connected Amazon. You do not need to re-authorise, you do not need a new refresh token, and you do not need to re-enter your Seller ID.
The only thing that changes is the secret itself. Everything else — your regions, your marketplaces, your order sync and stock push settings — is untouched.
Where do I enter the new Amazon secret in Flow?
- Go to Admin → Sales Channels and open the Amazon tab.
- At the top, above the region cards, find the Account credentials box.
- Paste the new secret into LWA Client Secret. Leave LWA Client ID as it is — it does not change when you rotate a secret, and it should already be filled in.
- Flow asks "Was this secret rotated today?" - Choose Yes if you have just generated it. Flow sets today as the rotation date. - Choose No if you generated it earlier, then pick the day you actually generated it.
- Flow works out the expiry as 180 days after that date and shows it in Expires on. Check it against the Rotation Deadline you noted from Amazon and correct it if they differ. Amazon's deadline includes a time of day, so the calculated date can be a day out either way.
- Click Save account credentials.
You should see a confirmation naming every region it saved to, for example *"Saved. Regions updated (3): EU, FE, NA."*
Do I have to update the secret for every Amazon region separately?
No — and this is important if you sell in more than one region.
Amazon issues one client ID and one client secret per application, and they are the same in every region you sell in. Only your Seller ID and your authorisation differ per region.
So the client ID and secret are entered once, in the Account credentials box, and Flow saves them to all of your Amazon regions together in a single step. You cannot update one region and forget another — either every region is updated or none is, and the confirmation message tells you how many were changed.
If you have used an older version of Flow where the secret appeared inside each region's own form, that is no longer the case. Do not look for it there.
How do I know the new Amazon secret actually worked?
After saving, open the Amazon connection and use Test connection (also called Validate). A successful test means Amazon accepted the new secret.
You can also simply watch normal activity resume: new orders appear at the next sync, and stock changes start reaching Amazon again.
My Amazon secret already expired — what do I do now?
Exactly the same steps as above. There is no separate recovery process and nothing is permanently broken.
Once you save a working secret, order importing and stock push resume by themselves. Two things are worth doing straight after:
- Check your Amazon stock levels. While the connection was down, Amazon kept showing the last number it received. If you sold anything in the meantime, Amazon's figure may be too high.
- Check for missed orders. Orders placed while the connection was down are imported once it recovers, but they arrive late, so anything time-sensitive may need attention.
Why does Amazon say "invalid_client" or my connection shows an authentication error?
An invalid_client error from Amazon almost always means the client secret is wrong or expired. The usual causes, in order of how often they happen:
- the secret has passed its 180-day deadline and needs rotating (this page),
- the new secret was copied incompletely — a missing character at either end is easy to do,
- the App ID was pasted into the Client ID field instead of the real Client identifier (see the warning further up this page).
If you have just pasted a new secret and immediately get this error, re-copy the secret from Amazon and paste it again before assuming anything else is wrong.
When will I have to do this again?
180 days after the rotation date you entered. Flow shows that date in Expires on in the Account credentials box, and will warn you 20 days before it arrives — provided the date is filled in.
If Expires on is empty, no warning can be produced, and the first you will know about it is Amazon's own 30-day notice or the connection breaking. It is worth entering the date even if you rotated the secret some time ago.