Amazon Seller Central user permissions, and how to give an agency access

Amazon Seller Central is where sellers manage their products, inventory and orders. It has two ways to let other people in without handing over the main login. Manage Employees is for people inside the seller’s organization, and Manage Services is for outside businesses. Both are forms of delegated access. When your agency runs a client’s Seller Central, which route you come in through decides who handles your staff changes.

The primary user, and two ways to add people

Seller Central Help calls the person who registers the account the primary user, also known as the account administrator. At first, only that person can use the account’s tools. Adding anyone else needs user permissions, which only sellers on a Professional selling plan can use.

The two routes are split by whether the person is inside or outside the seller’s organization.

When the seller invites people as employees

The primary user opens the Settings menu and chooses User Permissions. Under Manage Employees, they choose Invite Employee, enter the person’s details, and send the invitation. The new user follows the steps in the email. To change someone’s permissions, the primary user chooses Edit next to that person’s name in the same section.

Employees can’t open the permissions page. The exception: when the primary user or another administrator gives an employee the “View and edit” permission for the user permissions page, that employee becomes an administrator. An administrator can manage permissions for other employees and for service providers.

To remove an employee, the primary user or an administrator opens Manage Employees, opens the menu next to the person, and chooses Remove user.

Authorizing your agency as a Service Provider

This route needs some setup on your agency’s side first. Amazon’s Selling Partner API documentation says you create one company account in Solution Provider Portal, the screen where agencies and developers register with Amazon. Then you pick the category of service you offer and apply for Seller Central roles, the sets of tools you need. Approval can take up to 10 business days. Until then, those roles appear grayed out to sellers and can’t be granted.

The seller then opens an authorization link you send, or finds your agency in Service Provider Network, Amazon’s directory of providers, and chooses Authorize Now. Only the account owner or an account administrator can do this. They review the roles, can switch some off or limit access by country or region, and choose Authorize Provider. That gives your agency 365 days of access. If you’re listed on Service Provider Network, you get a service request, and access starts only after you accept it.

After that, your agency’s admin decides which staff work on which client, using Update Client Access in the portal. Each person gets one of three levels: View, View & Edit, or Admin. Staff sign in to Seller Central with the email address they registered in the portal. The developer documentation says your account administrators can monitor user activity, but it doesn’t say what is recorded.

Removing access

There are three cases, depending on who is being removed.

1. One staff member from one client. Your admin chooses Remove from Client in Solution Provider Portal. For someone who is leaving, Remove User takes them off your agency’s account and every client at once. The seller doesn’t need to do anything.
2. Your whole agency. The seller’s account owner or an administrator opens Manage Services, chooses Remove next to your agency, and confirms. Removal takes effect immediately and ends your access to every role and all data in the account. It can’t be undone, so restoring access means a full new authorization. Removal doesn’t cancel any contract you have with the seller outside Seller Central.
3. Expiry. After 365 days, access ends automatically. The seller gets reminders before then, and while access is still active, Reauthorize extends it for another 365 days.

If your staff were invited as employees instead, cases 1 and 3 don’t apply and access never expires. Your agency can’t remove its own people unless one of them is an administrator. Each staff change needs the seller’s primary user or an administrator to choose Remove user.

Two-step verification and passwords

Two-step verification is required for Seller Central. After the password, you enter a code sent to a device you chose, through an authenticator app, a text message or a voice call.

Amazon recommends that everyone who uses a seller account have their own login, with a different email address, set up through User Permissions. It warns that not doing so could be a security risk and could lock out others who use that login. With separate logins, each person turns on two-step verification for their own login, so codes go to each person’s own device.

On passwords, the user permissions page says “account credentials are unique, and confidential information should not be shared with anyone.” Section 16 of the Amazon Services Business Solutions Agreement says “You may not disclose your password to any third party.” It makes one exception: “third parties authorized by you to use your account in accordance with this Agreement.” Help doesn’t say whether handing over the password outside user permissions fits that exception. The seller is responsible for the actions of users it adds (the user permissions page) and for anything done under its password (section 16).

You can add users to a seller account, but you can’t transfer the account. If the business changes hands, the new owner sets up a new seller account.

When neither route is available

On the Individual plan, user permissions aren’t available, so there’s no Help-supported way to add your staff.

On a Professional plan, the Service Provider route opens only after Amazon approves your agency’s roles. Until then, the seller can do the work itself. The employee route is meant for the seller’s own staff. For anyone outside the organization, Seller Central Help describes Service Provider access as the correct method, rather than sharing the main login.