Amazon API access denied? Find the exact error, then the exact fix.
“Access denied” is six different problems wearing the same coat. Some are a code bug you can fix in ten minutes. One is a sales threshold no amount of code will move. This page tells you which one you have.
The short version
- Read the error type, not the HTTP status. Several unrelated problems all return 403, which is why so much advice on this is wrong.
AssociateNotEligibleis a sales problem, not a code problem. Amazon requires 10 qualifying sales in the trailing 30 days. Nothing in your configuration will change that.- It is a rolling window, so access can be taken back. This is why publishers with working credentials for years suddenly find every product box empty.
InvalidSignatureis very often just a wrong server clock. Check that before rewriting anything.- PA-API 5.0 was switched off in May 2026. If your plugin still calls it, that is its own failure mode.
Amazon’s API errors are unusually unhelpful. The same 403 covers a credential typo, a clock drift, a permissions issue and an eligibility threshold, and the message text rarely distinguishes them. People spend days regenerating keys for a problem that keys cannot fix.
Find your error type in the table below and go to that section.
The error codes, and what each one actually means
| Error type | Status | What it really means | Fixable by you? |
|---|---|---|---|
AssociateNotEligible |
403 | Your account does not meet the eligibility requirements — in practice, fewer than 10 qualifying sales in the trailing 30 days. | No. Only more sales fix this. |
InvalidAssociate |
403 | The account is not a valid Associate for that marketplace, or is not in good standing. | Check account status |
InvalidPartnerTag |
400 | The partner tag is not mapped to a valid associate store for that access key. | Yes — minutes |
InvalidSignature |
403 | The request was not signed correctly. Very commonly a server clock that has drifted. | Yes — often minutes |
TooManyRequests / RequestThrottled |
429 | You exceeded your request rate. Your quota is tied to your sales volume, so new accounts have very little. | Yes — throttle and cache |
ItemNotAccessible |
200 + error | That specific ASIN cannot be returned — often not sold in that marketplace, or restricted. | Yes — per product |
invalid_client |
401 | Creators API credential problem — usually wrong client ID/secret or an unmigrated app. | Yes |
Compiled from Amazon’s Product Advertising API troubleshooting documentation and the Creators API docs, checked 25 August 2026.
AssociateNotEligible — the one that is not your fault
This is the error the majority of people arrive here with, and it is the only one on the list you cannot code your way out of.
Amazon’s Creators API documentation states the requirement plainly: you must “have at least 10 qualifying sales within the past 30 days” to access the API. Below that, requests return AssociateNotEligible with a 403.
Two details make this much more painful than it first appears.
It is a rolling window, not a one-time unlock
Access is not granted permanently once you cross the line. Amazon evaluates the trailing 30 days continuously. Fall below ten and access is withdrawn — and every product box on your site that depends on live data stops working at once.
Nobody is certain what counts as a “qualifying sale”
Amazon has not defined this precisely and its support agents have given contradicting answers. The working interpretation across the affiliate community is shipped items rather than orders — so one order containing five items counts as five. Returns and cancellations come back out.
Plan against the stricter reading. If you are hovering at ten or eleven, you are not safely above the line.
The threshold moved recently. It was widely reported as a single qualifying sale in the trailing 30 days until late 2025, when it became ten. If you read an article saying you need one sale, or three, it predates the change. This is also why long-established publishers started hitting the error in 2026 — the rule moved under them, not their traffic.
What to do about it
- Check your actual number first. Associates reports, shipped items, last 30 days. Confirm you are genuinely below ten before assuming anything else.
- Concentrate sales into a window. The requirement is ten in 30 days, so ten spread over three months does not qualify. If you are at seven, a seasonal push or an email to your list is worth more than another month of trickle.
- Promote cheaper items temporarily. You need units, not revenue. A $25 accessory counts exactly as much as a $900 television.
- Keep the site working without the API in the meantime — see adding Amazon products without API access for what you may legitimately display while locked out.
The errors you can actually fix
InvalidSignature — check the clock before the code
Requests are signed, and the signature includes a timestamp. Amazon rejects requests whose timestamp is too far from its own clock. A server whose time has drifted produces a constant stream of InvalidSignature errors that look exactly like a credential problem.
- Check the server clock first. If it is off by more than a few minutes, that is your answer. Enable NTP.
- Check for a stray space or newline when the secret key was pasted — an invisible trailing character is extremely common.
- Confirm you are signing for the right region and host. Each marketplace has its own endpoint.
- Only then regenerate the keys.
InvalidPartnerTag — the tag and the key must belong together
Your partner tag must be mapped to the associate store that owns the access key. Mismatches happen when someone has several stores, or a tag for one marketplace and credentials for another.
Check that the tag is spelled exactly as it appears in Associates Central including the marketplace suffix, that it belongs to the same account as the access key, and that you are calling the endpoint for that marketplace.
TooManyRequests — your quota is smaller than you think
Request limits are tied to sales volume. A new account with minimal sales gets very little throughput, and the limit is low enough that an ordinary page build can exceed it.
- Cache aggressively, within the rules — up to 24 hours is permitted for price and availability data, provided you display the required timestamp and disclaimer.
- Never call the API on page load. Serve visitors cached data and refresh on a schedule in the background.
- Batch by ASIN. One request for ten items beats ten requests.
- Back off on 429 rather than retrying immediately, which makes it worse.
This is worth knowing before you choose a plugin. A tool that requests fresh data every time a visitor loads a page will burn a new account’s entire quota and then show errors to your readers. Ask how a plugin caches and how it schedules refreshes — on a small account it matters more than any feature.
ItemNotAccessible — usually the product, not you
This one is per-ASIN. The item is typically not sold in the marketplace you are querying, is restricted, or has been withdrawn. If it affects one product, it is that product. If it affects everything, look at the errors above instead.
Products disappearing from the API is also a slow, invisible revenue leak — see how to find dead Amazon affiliate links.
If you are still calling PA-API 5.0
PA-API 5.0 was switched off on 15 May 2026 and replaced by the Amazon Creators API. If your plugin or code still targets the old endpoints, failures there are not an eligibility problem at all. What changed between PA-API 5 and the Creators API covers the new credentials, the one-hour token and the rate limit that now follows your revenue.
The Creators API is REST-based and exposes the operations you would expect: SearchItems, GetItems, GetVariations and GetBrowseNodes. Credentials are issued separately — an old PA-API access key pair is not automatically a Creators API client.
- Register for Creators API access in Associates Central and generate new credentials.
- Confirm your plugin supports it. Anything still describing “PA-API 5.0” in its current documentation is behind.
- An
invalid_client401 during setup normally means the client ID or secret is wrong, or the app was never migrated.
Not losing access again
Because eligibility is now continuous, treat it as something to monitor rather than something you achieved once.
Watch the 30-day count
Check shipped items for the trailing 30 days monthly. Dropping to eleven is a warning, not a comfort.
Cache so an outage is survivable
If your site holds recent product data, a short loss of access degrades quietly instead of emptying every page.
Do not depend on price everywhere
Pages built around a “check price on Amazon” button keep working when the API does not.
Keep some non-API content
Your own photographs and your own testing notes never expire, and no policy change can remove them.
Part of The Amazon Affiliate Site Playbook — the whole job in six stages, from choosing a niche to keeping a mature site earning.
Keep the site working when the API does not
Ama Affiliate Pro caches within Amazon’s rules, refreshes on a schedule rather than on page load, and falls back to a compliant no-price box if access is withdrawn — so a quiet month does not blank every product on your site.
Start a 14-day trialCommon questions
How do I fix the AssociateNotEligible error?
You cannot fix it in code. It means your account is below Amazon’s eligibility threshold — currently 10 qualifying sales in the trailing 30 days. The only fix is more sales inside a 30-day window. Check your shipped-items report for the last 30 days to confirm that is what is happening before changing anything else.
I had API access for years and it stopped. Why?
Eligibility is evaluated on a rolling 30-day window, so access can be withdrawn as well as granted. A quiet month can drop you below ten qualifying sales and take the API with it. The threshold also rose in late 2025, which pushed a lot of long-standing publishers below a line they had never had to think about.
What counts as a qualifying sale?
Amazon has not defined it precisely, and support answers have been inconsistent. The community’s working interpretation is shipped items rather than orders, so one order of five items counts as five. Returns and cancellations are deducted. Assume the stricter reading when planning.
Why do I keep getting InvalidSignature with correct keys?
Check your server’s clock. Requests are signed with a timestamp and Amazon rejects those too far from its own time, so a drifting clock produces constant signature failures that look like a credential fault. After that, check for a trailing space or newline in the pasted secret key, and confirm you are signing for the correct regional endpoint.
How many API requests am I allowed?
Your rate and daily quota are tied to your sales volume, so a new account gets very little. This is why calling the API on every page load fails quickly. Cache within the permitted window, refresh on a schedule in the background, and batch multiple ASINs into single requests.
Is PA-API 5.0 still available?
No. It was switched off on 15 May 2026 and replaced by the Amazon Creators API. You need to register for Creators API credentials separately — an old PA-API key pair does not carry over. Any plugin whose current documentation still describes PA-API 5.0 is out of date.
Will contacting Amazon support restore my API access?
Not if the cause is eligibility. Support cannot waive the sales threshold, and asking generally produces a restatement of the requirement. It is worth contacting them only if you believe your sales genuinely are above the threshold and the error persists, in which case give them your figures for the trailing 30 days.
Can I run my site while I wait for access?
Yes. Tagged text links work with no API access at all, and you can build product boxes from your own photographs and your own descriptions. You cannot show prices or Amazon’s product images without the API. There is a full guide to what is permitted in adding Amazon products without API access.