@sp-api-sdk/auth

@sp-api-sdk/auth

Amazon Selling Partner API authentication package

Installing

• npm install @sp-api-sdk/auth

Authentication models

This library supports both authentication models: IAM user credentials, or an IAM role (using STS AssumeRole).

Using an AWS IAM user

import { SellingPartnerApiAuth } from "@sp-api-sdk/auth";

const auth = new SellingPartnerApiAuth({
  clientId: "",
  clientSecret: "",
  refreshToken: "Atzr|...",
  accessKeyId: "",
  secretAccessKey: "",
  sessionToken: "", // If you’re authenticated using temporary credentials
});

const accessToken = await auth.accessToken.get();
const { AccessKeyId, SecretAccessKey } = await auth.getCredentials();

Using an AWS IAM role

import { SellingPartnerApiAuth } from "@sp-api-sdk/auth";

const auth = new SellingPartnerApiAuth({
  clientId: "",
  clientSecret: "",
  refreshToken: "Atzr|...",
  accessKeyId: "",
  secretAccessKey: "",
  region: "", // You can provide an AWS region that will be used for the STS calls
  role: {
    arn: "",
    sessionName: "SellingPartnerAPI", // Optional
  },
});

const accessToken = await auth.accessToken.get();
const { AccessKeyId, SecretAccessKey, SessionToken } = await auth.getCredentials();

getCredentials will return a set of temporary security credentials that last for 1 hour.

Default values from the environment

These constructor options can be passed using environment variables:

Property Name	Environement variable
clientId	LWA_CLIENT_ID
clientSecret	LWA_CLIENT_SECRET
accessKeyId	AWS_ACCESS_KEY_ID
secretAccessKey	AWS_SECRET_ACCESS_KEY
sessionToken	AWS_SESSION_TOKEN
region	AWS_DEFAULT_REGION
role.arn	AWS_ROLE_ARN
role.sessionName	AWS_ROLE_SESSION_NAME

Grantless APIs support

Some APIs require grantless authentication, which is done by passing scopes, instead of a refresh token. The available scopes are exposed in the AuthorizationScope enum from this library.

import { SellingPartnerApiAuth, AuthorizationScope } from "@sp-api-sdk/auth";
import { AuthorizationApiClient } from "@sp-api-sdk/authorization-api-v1";

const auth = new SellingPartnerApiAuth({
  clientId: "",
  clientSecret: "",
  scopes: Object.values(AuthorizationScope), // Or choose the only ones you need
  accessKeyId: "",
  secretAccessKey: "",
});

const accessToken = await auth.accessToken.get();
const credentials = await auth.getCredentials();

Credentials caching

accessToken.get() caches the access token for its whole duration, it will only request a new token if the current one has expired.

The same goes for the STS temporary credentials returned by getCredentials, the credentials are cached until they expire.