An agency can work on your Amazon account only if the account owner authorises it, as a service provider, with permissions the owner chooses. Since 1 September 2026 Amazon has tightened this further: service providers must pass a business verification, and authorisations expire after 365 days unless renewed.
For a group, this turns agency access into something IT and procurement can govern: a named provider, a defined scope, an expiry date and a revocation that takes effect immediately. And it settles an old bad habit: a serious agency never asks for your password.
What changed on 1 September 2026?
Amazon changed how agencies, freelancers and virtual assistants access Seller Central:
- Business verification: service providers must complete it before accessing your account.
- Time-limited access: authorisations expire after 365 days. Amazon notifies you before expiry, by email and in the Seller Central action centre, so the decision to continue stays with you.
- Permission selection: you grant only the permissions the work requires.
If an authorisation is not renewed in time, the provider loses access until you act. You can restore, change or revoke it at any time.
Why should no one outside the company hold the account login?
Amazon says so itself. Announcing passkeys for Seller Central in July 2026, it stated that for security reasons it does not support sharing a single login between several users: everyone who works on the account needs their own access.
There is also a practical reason. Whoever logs in with the owner’s credentials is, for Amazon, the owner: there is no record of who did what, no way to limit what they see, and no clean way to end the relationship. Shared access can also trigger related-account checks, and in the Italian seller forum there are sellers describing exactly that: an account blocked for being related to the agency that managed it.
It is worth putting access and permissions in order before it becomes a security or related-account problem. We tell you where to start in a free 30-minute call.
Does the same principle apply to Vendor Central?
Yes. On Vendor Central too, the account owner decides who has access and with which permissions. An agency managing a Vendor account should work through its own access, granted by you, never through your credentials. For groups, where Vendor accounts often carry the largest volumes, this is the access to review first.
What should a group ask before giving an agency access?
- That it asks to be authorised, not to be given a password.
- Which permissions it needs, and why: a team running advertising has no reason to see payments.
- That control stays with you: the access is yours and can be revoked in one step.
- Credentials you can verify, such as membership of Amazon’s Service Provider Network and a listing in the Amazon Ads partner directory.
- A named person accountable for the account, not a ticket queue.
We are certified Amazon SPN, Amazon Ads Advanced, Amazon DSP Advanced and Amazon Gold Partner and work only through access authorised by the account owner. Every account has a named person on it.
How do we work?
We work only through access authorised by the account owner, on Seller Central and Vendor Central. We are certified Amazon SPN, Amazon Ads Advanced, Amazon DSP Advanced and Amazon Gold Partner. Most of the brands we work with are bound by non-disclosure agreements, so we do not name them. When a project starts, we send the client step-by-step instructions and the list of permissions we need for the agreed scope, and nothing more. When the engagement ends, the owner closes the access in one click.
See how our Amazon account management and Vendor Central management are organised.
Suspensions, performance, compliance: talk it through with someone who does it daily. The 30-minute call is free.
