What Replaced the Product Advertising API and Who Gets Access

Open Amazon's Product Advertising API documentation today and there is nothing to open. On August 21, 2026 the documentation root, the registration page and the request-rates page all answered with a 302 to the same deprecation notice. The UK and German documentation hosts answer 403.

That PA-API 5 was retired in favor of the Creators API is old ground here, covered in the article on self-updating affiliate sites. What has never been written down here is the machinery underneath: who Amazon lets in now, how many calls you get, how the key is lost, and which license clauses switch on when product data lands on your page.

I run Associates accounts in the US, the UK and Germany, so the market question below is the one I care about most. Everything here was read off Amazon's live pages on August 21, 2026, and the gaps are marked as gaps.

Where the documentation went

The notice is short. "The Amazon Product Advertising API 5.0 (PA-API 5) has been deprecated and is being replaced by the Creators API," it says, calling the Creators API the supported successor. Applications still calling the old interface get HTTP 403 and a com.amazon.paapi5#AccessDeniedException pointing at the migration guide. That is Amazon's account of the behavior, not a test I ran, since calling the endpoint requires credentials.

What the notice does not carry is a date. No sunset day, no migration window, no timetable. Anyone quoting you a shutdown date for the old interface is not reading it off Amazon's page.

The migration guide is blunt about what does not carry over: "Your existing Product Advertising API credentials (AWS Access Key and Secret Key) will not work with the Creators API." The rest of the move:

The access gate, in Amazon's own words

The eligibility line is one sentence: "Have at least 10 qualifying sales within the past 30 days to access the PA API through the Creators API." Not ten sales ever. Ten inside a rolling thirty-day window, so the gate closes behind you as easily as it opened.

Amazon's introduction lists the prerequisites:

• Be registered as an Amazon Associate in the marketplace you want data from.
• Have at least ten qualifying sales in the past thirty days.
• Register through Associates Central and generate API credentials.

The threshold appears again in a second document. Under AccessDeniedException the error reference carries a reason code, AssociateNotEligible: "The current eligibility criteria is that the account must have made 10 qualified sales in the trailing 30 days." The caller only sees "Your account does not currently meet the eligibility requirements."

Two gates stack here. Registration first requires an Associates account "that has been reviewed and received final acceptance," and sign-up is open only to associates who have already referred qualified sales. That acceptance rule has its own numbers, in the article on the acceptance window, and clearing it does not clear this one.

Amazon does not publish when the ten-sale criterion took effect. No effective date appears on any of these pages, so a smaller figure cannot be sourced to Amazon's current wording.

The same gate in the UK and Germany

The identical English sentence sits on affiliate-program.amazon.co.uk and on partnernet.amazon.de, both answering 200. Localized paths do not exist: the en-gb and de-de versions return 404. UK and German associates read the same English page as US associates, and no separate threshold is stated for either.

Whether access is granted once or once per market is genuinely unresolved, because two Amazon pages disagree. Registration says you "can only use the Creators API for the marketplace that you registered for as an Amazon Associate." The FAQ says credentials "work globally across all marketplaces," that you switch with the x-marketplace header and marketplace parameter, and that you need "a valid Partner Tag for the target marketplace and Creators API access approved in that region."

Amazon never reconciles the two. The only reading that fits both is a global credential with per-marketplace authorization, which mirrors how tags behave across markets, taken apart in the multi-country article. My reading, not a ruling.

What registering actually produces

Registration runs inside Associates Central: the Tools menu, then Creators API, then Create Application, then generate a credential. Out come three values, a Credential ID, a Secret and a Version, downloadable as a CSV. The caps are narrow:

• Only the primary account owner can register.
• Two applications per store, and two credential sets per application.
• The Secret is shown once, at creation. Lose it and you generate a replacement rather than recover it.
• An application deletes only after every credential under it has been deleted.

Whether that menu item appears for an account below the threshold is not documented, and I am not describing a screen I have not verified.

How much you are allowed to call, and how that grows

New credentials start with "an initial usage limit up to a maximum of one request per second (one TPS) and a cumulative daily maximum of 8640 requests per day (8640 TPD) for the first 30-day period." One call carrying ten ASINs counts as a single transaction, so the budget is spent on calls, not products.

After that the allowance has to be earned. Your account gains "one TPD for every five cents or one TPS (up to a maximum of ten TPS) for every $4,320 of shipped item revenue generated via the use of Creators API for shipments in the previous 30-day period," recalculated daily. That revenue means items Amazon actually shipped from links the API produced.

Daily headroom therefore grows almost at once, since five cents is a low step. Rate headroom barely moves, since each extra request per second costs a full $4,320 of shipped revenue.

How access is lost, and how it comes back

Access is not permanent. Your account "will lose access to Creators API if it has not generated qualified referring sales for a consecutive 30-day period." Thirty quiet days and the key is withdrawn, however well the integration is written.

Two details soften that. The rest of the program continues, with Site Stripe named as still available, and building links by hand is covered in its own article. The door reopens by itself "within two days after your referred sales are shipped." Shipped, not ordered, the same clock the quota formula runs on.

Amazon breaks out which sales it counted as API-attributed in the Link Type Performance report inside Associates Central.

One trap: running over quota and having access revoked look identical from outside. Both return 429 TooManyRequests, called a ThrottleException in the error reference and carrying a retryAfterSeconds field, sixty in Amazon's example, with exponential backoff advised. A 429 is not proof you are calling too fast.

How attribution goes missing while the API works fine

A technically perfect integration can still pay nothing. Four conditions decide whether sales are credited:

• Use the links the API returns, and edit none of the URL parameters.
• Open the Associates account and the API account under the same Amazon email address.
• Make requests with the primary account's credentials.
• Send the Partner tag on every single request.

The consequence is stated flatly: "We cannot retroactively apply any sales credit to your account if you forget to do this correctly." And on the links, "Alterations of any kind to vended links will lead to missing attribution and loss of Associate fees." Amazon adds that it uses your Partner tag to monitor API usage and adjust access accordingly, so the tag pays you and rates you at once.

The freshness rule past the twenty-four hour ceiling

The twenty-four hour caching ceiling is already covered, in the piece on where the hours go. The rest of section 2(h) of the Program Policies, updated April 14, 2026, is stricter than that headline number:

• An image may not be stored or cached at all, though a link to one may be stored for a day.
• Cached non-image content must be refreshed and re-displayed immediately afterwards, by calling the API again or pulling a new Data Feed.
• ASINs are the exception, kept for an indefinite period until the license terminates.
• A client application may not store or cache any of it, and on request you have three business days to furnish Amazon with a copy of that application.

Amazon's own recommendation undercuts that ceiling: one hour for Offers and BrowseNodeInfo, one day for everything else. Caching customer information derived from Amazon is against the terms, and crawlers eat into request rates, with robots.txt offered as the fix.

Which source a displayed price may come from is a different clause, 2(b), and it is already owned by the article on breaches that close accounts, so I leave it there.

Four license clauses beyond the price rule

Section 2(k) requires a second disclaimer, separate from the earnings disclosure: "CERTAIN CONTENT THAT APPEARS [IN THIS APPLICATION or ON THIS SITE, as applicable] COMES FROM AMAZON. THIS CONTENT IS PROVIDED AS IS AND IS SUBJECT TO CHANGE OR REMOVAL AT ANY TIME." It triggers as soon as you display Amazon text, in plain view.

Section 2(d) restricts device class. Without express prior written approval you may not use product advertising content on any site or application "designed or intended for use with a mobile phone or other handheld device." Three carve-outs follow: a site not built for mobile that a tablet can reach, an Approved Mobile Application, and a set-top box or internet-connected television. How that reads against an ordinary responsive theme is not published, so I claim nothing about enforcement. It governs product data, not link placement.

Section 2(e) has aged into relevance. Without written approval you may not use the API "for the purpose of aggregating, analyzing, extracting, or repurposing any Product Advertising Content," nor "in the direct training or fine-tuning of a machine learning and/or foundational model." The clause above it goes wider, covering large language and multimodal models.

Clause 4 covers agents, "any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity." An agent must carry Agent/[agent name] in its user agent string, must not disguise what it is, must answer an is-this-a-human question truthfully, and must not bypass limits on agent access. Mimicking human keystroke speed and solving CAPTCHAs are named. More of the rule set sits in the complete rules guide.

What to do while the gate is shut

The API is not a tool you adopt. Ten qualifying sales in a rolling thirty days describes a site that already works, access survives only while sales keep arriving, and the permitted rate rises with shipped revenue. Every dial is downstream of results you already have.

Three things Amazon does not answer, better carried as gaps than guesses: no published shutdown date for the old interface, no effective date for the ten-sale rule, and two contradictory answers on whether access is granted once or once per marketplace.