Amazon Creators API is replacing PA-API 5.0 — what affiliate marketers need to know

If you've run Amazon affiliate tables, price-checkers, or product feeds any time in the last decade, you've talked to PA-API 5.0 — the Product Advertising API with AWS Signature v4 + AKIA-style keys. On May 15, 2026, Amazon retired it. The replacement is the Creators API, and it's not a config change. It's a new authentication scheme, a different request shape, and a stricter eligibility requirement.

This is the practical migration guide we wish existed when we ported Velantio's Amazon client over.

TL;DR

• PA-API 5.0 (AWS Sig v4 + AKIA keys) → Creators API (OAuth2 + Bearer tokens)
• New eligibility floor: 10 qualifying sales in the last 30 days (up from 3)
• New host: creatorsapi.amazon (yes, with the .amazon TLD)
• New endpoints: POST /catalog/v1/getItems, POST /catalog/v1/searchItems
• Tokens are 1-hour OAuth2 access tokens — cache them
• All request fields are now lowerCamelCase (ItemIds → itemIds)
• Up to 10 ASINs per GetItems call (same cap as before)

Why the change happened

The Creators API consolidates Amazon's affiliate-data surface area. Old PA-API 5.0 was IAM-style auth with credentials issued through AWS's own console — a confusing onboarding for affiliate marketers who'd never touched AWS. The new flow is OAuth2 client-credentials issued inside Amazon Associates Central itself, which matches how Login With Amazon (LWA) works.

The eligibility bump from 3 → 10 sales / 30 days is also a quiet way for Amazon to filter out testing accounts and bad actors. If you're an active affiliate, you'll qualify quickly; if you've been holding a dormant account, you'll need to drive real traffic first.

Credential anatomy

When you create a new credential in Associates Central → Tools → Creators API → Add new credential, you get three values:

• Credential ID — looks like amzn1.application-oa2-client.92fa38bc8db0465d9598eec6b0d8d10e
• Credential Secret — looks like amzn1.oa2-cs.v1.c882771901ef51b773d8226a2a718a794fab536faaaa9e1cfcbb74f87ed47a58
• Version — v3.1 (NA), v3.2 (EU), v3.3 (FE), or the older v2.x Cognito variants

The version determines two things at once: which token endpoint to call and which Amazon region you can query. v3.1 covers US/CA/MX/BR; v3.2 covers UK/DE/FR/IT/ES; v3.3 covers JP/IN/AU.

The secret is shown only once. Copy it before closing the dialog or you'll have to delete and recreate.

The OAuth2 token exchange

For v3.x (LWA-style), POST to https://api.amazon.com/auth/o2/token (or the regional equivalent):

POST /auth/o2/token HTTP/1.1
Host: api.amazon.com
Content-Type: application/json

{
  "grant_type": "client_credentials",
  "client_id": "amzn1.application-oa2-client.…",
  "client_secret": "amzn1.oa2-cs.v1.…",
  "scope": "creatorsapi::default"
}

Response:

{
  "access_token": "Atza|…",
  "token_type": "bearer",
  "expires_in": 3600
}

Cache this in process memory with a ~60s safety buffer. Don't fetch a new token for every PA-API call — that's how you get throttled.

For v2.x (Cognito-fronted) the format is application/x-www-form-urlencoded with HTTP Basic auth and a scope=creatorsapi/default (single colon). Most accounts will get v3.x; v2.x is the older fallback.

Calling GetItems

The endpoint is identical for every marketplace — region is signaled by the x-marketplace header instead of the host.

POST /catalog/v1/getItems HTTP/1.1
Host: creatorsapi.amazon
Authorization: Bearer <access_token>
Content-Type: application/json
x-marketplace: www.amazon.com

{
  "itemIds": ["B08N5WRWNW"],
  "itemIdType": "ASIN",
  "resources": [
    "images.primary.large",
    "itemInfo.title",
    "offersV2.listings.price",
    "customerReviews.starRating",
    "customerReviews.count"
  ],
  "partnerTag": "yoursite-20",
  "partnerType": "Associates",
  "marketplace": "www.amazon.com"
}

Response structure mirrors PA-API 5.0 but the keys are lowerCamelCase. So it.Offers.Listings[0].Price.DisplayAmount becomes it.offersV2.listings[0].price.displayAmount.

What you'll trip over

.amazon TLD. Yes, the host really is creatorsapi.amazon — Amazon owns the .amazon gTLD. Some intrusion-detection systems and corporate proxies block unfamiliar TLDs. If your network throws a DNS error, that's the first thing to check.

Region mismatch. v3.1 credentials cannot query the UK marketplace. Validate marketplace ∈ region at request time — Amazon returns a confusing 400 if you don't.

Eligibility errors look like 403s. When Amazon decides your account doesn't have 10 qualifying sales yet, you get an HTTP 403 with the message "Your account does not currently meet the eligibility requirements". This is not a credentials bug — it's account state. You can't fix it in code.

Token caching is mandatory. PA-API throttles at roughly 1 request per second per credential. If you re-fetch a fresh token before every API call, you've used your quota on token exchanges. Cache the access token until 60 seconds before expires_in.

A reference client (TypeScript)

The minimal version is about 250 lines. We open-sourced the auth shape in Velantio's repo; the heart of it is:

async function getAccessToken(creds): Promise<string> {
  const cached = tokenCache.get(creds.credentialId)
  if (cached && cached.expiresAt > Date.now() + 60_000) return cached.accessToken

  const res = await fetch('https://api.amazon.com/auth/o2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      grant_type: 'client_credentials',
      client_id: creds.credentialId,
      client_secret: creds.credentialSecret,
      scope: 'creatorsapi::default',
    }),
  })
  const { access_token, expires_in } = await res.json()
  tokenCache.set(creds.credentialId, {
    accessToken: access_token,
    expiresAt: Date.now() + expires_in * 1000,
  })
  return access_token
}

Then your API call is just an authenticated POST with the right headers.

What this means for your stack

If you maintain your own Amazon affiliate code, plan to spend a half day porting. The rough work order:

1. Rewrite the auth layer — OAuth2 token exchange + in-process cache
2. Drop AWS Sig v4 signing entirely
3. Update endpoint URL to creatorsapi.amazon/catalog/v1/{operation}
4. lowercase the first letter of every request param
5. Update response field names everywhere your mapper reaches
6. Set the x-marketplace header per call
7. Validate region/version match before sending

If you're on a hosted tool — Lasso, AAWP, Affiliatable, Velantio — your vendor should have already handled this. If you're not sure, ask them and check that they're hitting creatorsapi.amazon, not the retired webservices.amazon.com/paapi5.

Bottom line

This was a real migration, not a rename. The auth is fundamentally different, eligibility is stricter, and the API has more sensible casing. If you're a working affiliate marketer with steady traffic, the only practical change is "click a different button in Associates Central". If you write the integration yourself, set aside an afternoon.

If you don't want to write any of this, Velantio handles the Creators API end-to-end under your own credentials — the same auth model, just we keep up with Amazon's API churn so you don't have to.