The Creators API replaced PA-API 5. Here is what actually changed.
New credentials, a token that expires every hour, a different endpoint and a rate limit tied to your sales. If a product box on your site stopped updating this year, one of these is why.
The short version
- PA-API 5 is gone. Amazon’s deprecation page says calls to it now return
403 ForbiddenwithAccessDeniedException. - Your old keys do not carry over. The Creators API uses a Credential ID and Secret, exchanged for a token that lasts one hour.
- The 10-sale rule still applies. 10 qualifying sales in the past 30 days to get in, and 30 days with none to lose access.
- Your request budget follows your revenue. After the first month, one request a day per five cents of shipped revenue. Batch and cache, or a small site runs out.
For most of the last decade, every Amazon product box on a WordPress site was powered by the same thing: the Product Advertising API, version 5. In 2026 Amazon retired it and moved affiliates to the Creators API. The product data is much the same. Almost everything around it is different, and plugins that were not updated simply stopped showing prices.
This page covers what changed, what it costs you in requests, and what to check on your own site. Every rule below was read from Amazon’s Creators API documentation in October 2026.
What happened, and when
Two things are worth separating. Amazon’s own PA-API 5 deprecation notice no longer prints a timeline. It says the Creators API is the supported successor and that applications still calling PA-API 5 receive 403 Forbidden with an AccessDeniedException message. The dates in the chart are reported: they come from developer and plugin-maker notices published while the switch was happening, and they agree with each other.
If your product boxes show no price but still show a title and image, you are probably looking at the January change, not the May one. Prices moved to a resource called OffersV2, and the migration guide lists the old Offers resource as not available on the Creators API.
What changed: PA-API 5 against the Creators API
| What | PA-API 5 (retired) | Creators API (current) |
|---|---|---|
| Credentials | Access Key + Secret Key | Credential ID + Credential Secret (secret shown once) |
| Authentication | AWS Signature Version 4 on every request | OAuth 2.0 client credentials → bearer token valid 3,600 seconds |
| Endpoint | webservices.amazon.com/paapi5/… | creatorsapi.amazon/catalog/v1/… |
| Marketplace | Part of the signed request | x-marketplace header, e.g. www.amazon.com |
| Parameter names | PascalCase — ItemIds, PartnerTag | lowerCamelCase — itemIds, partnerTag |
| Prices | Offers (V1 retired January) | OffersV2 only |
| Operations | GetItems, SearchItems, GetVariations, GetBrowseNodes | The same four |
| Batching | Up to 10 ASINs per GetItems | Up to 10 ASINs per GetItems |
The operations did not change, which is why the migration looks small on paper. The hard part is underneath: a request that used to be signed and sent in one step now needs a token first, and that token has to be stored and reused or you double every call.
Getting credentials, and which version to pick
Credentials are created in Associates Central. Amazon’s migration guide says to look for the Creators API section under the Tools menu, choose Create Application, then Create Credential. You get three values: a Credential ID, a Credential Secret and a Version. The guide warns that the secret is displayed only once, so copy it before you close the window.
The version number matters more than it looks, because it decides which Amazon server issues your token. In Ama Affiliate Pro the setting is a dropdown, and its labels spell out the mapping:
| Version | Region | Stores (examples) | Token issued by |
|---|---|---|---|
| 3.1 | North America | US, Canada, Mexico, Brazil | Login with Amazon, api.amazon.com |
| 3.2 | Europe | UK, Germany, France, Italy, Spain, India and others | Login with Amazon, api.amazon.co.uk |
| 3.3 | Far East | Japan, Australia, Singapore | Login with Amazon, api.amazon.co.jp |
| 2.x | Any | Older credentials | A separate Cognito sign-in service |
India sits in the Europe group, which catches people out. And if your credential version starts with 2, it was issued under the older sign-in service. One developer write-up reported 2.x credentials being retired in September 2026. Whether or not that has reached your account yet, creating a fresh 3.x credential costs two minutes and removes the question.
Amazon’s FAQ adds one more rule: the credentials themselves work in every marketplace, but you need a valid partner tag for that marketplace and Creators API access approved in that region. A US credential does not give you UK data without a UK tag. The step-by-step for entering all of this in WordPress is on the Creators API connection page of our docs.
Eligibility: the 10-sale rule did not go away
Amazon’s introduction page is direct about it: to use the API you must be enrolled in the Associates program for your target marketplace and have at least 10 qualifying sales within the past 30 days. The rate-limits page adds the two rules that matter once you are in:
- You lose access after 30 consecutive days with no qualified referring sales. A seasonal site can lose its API in the off-season.
- You get it back within two days of referred sales shipping. Shipping, not ordering, so there is a lag either way.
If you are not at 10 sales yet, the API is not the first job. Adding Amazon products to WordPress without API access covers what you can do legitimately in the meantime, and the API access-denied error guide covers what each refusal message means.
Rate limits: the part that bites small sites
From Amazon’s rates page: for the first 30 days you get 1 request per second and 8,640 requests per day. After that the allowance is recalculated daily from the shipped revenue you referred in the previous 30 days: one request per day for every five cents, and one request per second for every $4,320, up to a maximum of 10 per second. Go over and you get 429 TooManyRequests.
Run the arithmetic and the consequence is plain. The table below is our calculation from that published formula, in US dollars:
Two thousand requests a day sounds like plenty until you count. A site with 400 product boxes that refreshes each one every hour, one ASIN per call, needs 9,600 requests a day. The same site batching 10 ASINs per GetItems call and refreshing every six hours needs 160. Same products, same freshness that matters, sixty times fewer requests. Batching and caching are not optimisations on the Creators API. On a small site they are the difference between working and 429.
What to check on your WordPress site
- Your plugin speaks the Creators API. A
403withAccessDeniedExceptionon every lookup almost always means the plugin is still calling PA-API 5. Update it, or replace it. - You entered new credentials, not your old keys. An AWS-style access key in a Credential ID field will not authenticate. Credential IDs from Amazon begin with
amzn1. - The version matches your store’s region. A UK or Indian store with a 3.1 credential asks the wrong token server.
- The token is cached. Look for a setting or documentation note. If every product lookup requests a new token, you are spending half your allowance on sign-ins.
- Lookups are batched. Up to 10 ASINs per GetItems. A comparison table of eight products should cost one request, not eight.
- Prices come from OffersV2. If titles and images load but prices do not, the plugin is still asking for the retired
Offersresource.
For what it is worth, this is how we built it in Ama Affiliate Pro: the token is stored per credential and version and reused until 60 seconds before Amazon says it expires, so a page of product boxes costs one sign-in an hour rather than one per box. Before you reach 10 sales, the plugin can use a paid third-party product-data provider instead, and it switches that provider off automatically the moment your own Amazon credentials are saved, so two sources never answer for the same product with two different prices. None of that is unique to us; it is simply what the new API requires of any plugin that wants to stay inside a small site’s request budget.
Prices still need a timestamp. The Creators API did not change Amazon’s display rules. If you show a price, show when it was fetched, and refresh it. Our guide to links that stop tracking covers the other rules that cost commission without throwing an error.
Part of The Amazon Affiliate Site Playbook — the whole job in six stages, from choosing a niche to keeping a mature site earning.
Product boxes that already speak the Creators API
Ama Affiliate Pro connects to the Creators API with the three values from Associates Central, caches the token, batches lookups and refreshes prices on a schedule, so a small site stays well inside its daily allowance.
Start a 14-day trialCommon questions
What replaced the Amazon Product Advertising API?
The Amazon Creators API. It offers the same four operations (GetItems, SearchItems, GetVariations, GetBrowseNodes) but uses OAuth 2.0 credentials, a new endpoint at creatorsapi.amazon, an x-marketplace header and lowerCamelCase parameters. Amazon’s deprecation page states that calls to PA-API 5 now return 403 Forbidden.
Can I still use my PA-API access key and secret key?
No. The Creators API does not accept AWS-style access keys. You create a new Credential ID and Credential Secret in Associates Central, under the Creators API section of the Tools menu. The secret is shown once, so save it when you create it.
Do I need 10 sales to use the Creators API?
Yes. Amazon’s introduction page lists at least 10 qualifying sales within the past 30 days. Your account also loses access if it goes 30 consecutive days without a qualified referring sale, and regains it within two days after referred sales ship.
What are the Creators API rate limits?
For the first 30 days: 1 request per second and 8,640 requests per day. After that, Amazon recalculates daily from the previous 30 days of shipped revenue: one request per day for every five cents, and one extra request per second for every $4,320, up to 10 per second. Going over returns a 429 TooManyRequests error.
Why does my plugin show 403 AccessDeniedException?
Usually because it is still calling the old PA-API 5 endpoint, which Amazon now refuses. Update the plugin to a version that supports the Creators API and enter new Creators API credentials. If you are already on the Creators API, check that the account has 10 qualifying sales in the last 30 days.
Which credential version should I choose?
The one matching the region of the store you earn from. Login with Amazon credentials are versioned 3.1 for North America, 3.2 for Europe (including the UK and India) and 3.3 for the Far East (Japan, Australia, Singapore). Older 2.x versions used a different sign-in service; if yours starts with 2, create a new 3.x credential.
Can I add Amazon products to WordPress without the Creators API?
Yes. Text links and image links built from SiteStripe need no API at all, and a plugin can store product details you enter by hand. What you lose is automatic price and availability updates, which is why most sites move to the API once they pass 10 sales a month.