Security News
The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
@sp-api-sdk/auth
Advanced tools
@sp-api-sdk/auth
Amazon Selling Partner API authentication package
npm install @sp-api-sdk/auth
This library supports both authentication models: IAM user credentials, or an IAM role (using STS AssumeRole).
import { SellingPartnerApiAuth } from "@sp-api-sdk/auth";
const auth = new SellingPartnerApiAuth({
clientId: "",
clientSecret: "",
refreshToken: "Atzr|...",
accessKeyId: "",
secretAccessKey: "",
sessionToken: "", // If you’re authenticated using temporary credentials
});
const accessToken = await auth.accessToken.get();
const { AccessKeyId, SecretAccessKey } = await auth.getCredentials();
import { SellingPartnerApiAuth } from "@sp-api-sdk/auth";
const auth = new SellingPartnerApiAuth({
clientId: "",
clientSecret: "",
refreshToken: "Atzr|...",
accessKeyId: "",
secretAccessKey: "",
region: "", // You can provide an AWS region that will be used for the STS calls
role: {
arn: "",
sessionName: "SellingPartnerAPI", // Optional
},
});
const accessToken = await auth.accessToken.get();
const { AccessKeyId, SecretAccessKey, SessionToken } = await auth.getCredentials();
getCredentials
will return a set of temporary security credentials that last for 1 hour.
These constructor options can be passed using environment variables:
Property Name | Environement variable |
---|---|
clientId | LWA_CLIENT_ID |
clientSecret | LWA_CLIENT_SECRET |
accessKeyId | AWS_ACCESS_KEY_ID |
secretAccessKey | AWS_SECRET_ACCESS_KEY |
sessionToken | AWS_SESSION_TOKEN |
region | AWS_DEFAULT_REGION |
role.arn | AWS_ROLE_ARN |
role.sessionName | AWS_ROLE_SESSION_NAME |
Some APIs require grantless authentication, which is done by passing scopes, instead of a refresh token.
The available scopes are exposed in the AuthorizationScope
enum from this library.
import { SellingPartnerApiAuth, AuthorizationScope } from "@sp-api-sdk/auth";
import { AuthorizationApiClient } from "@sp-api-sdk/authorization-api-v1";
const auth = new SellingPartnerApiAuth({
clientId: "",
clientSecret: "",
scopes: Object.values(AuthorizationScope), // Or choose the only ones you need
accessKeyId: "",
secretAccessKey: "",
});
const accessToken = await auth.accessToken.get();
const credentials = await auth.getCredentials();
accessToken.get()
caches the access token for its whole duration, it will only request a new token if the current one has expired.
The same goes for the STS temporary credentials returned by getCredentials
, the credentials are cached until they expire.
FAQs
Amazon Selling Partner API authentication package
The npm package @sp-api-sdk/auth receives a total of 474 weekly downloads. As such, @sp-api-sdk/auth popularity was classified as not popular.
We found that @sp-api-sdk/auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.