TL;DR: Amazon MCP Setup in 7 Steps Amazon MCP connects AI assistants (Claude, ChatGPT, Gemini) to your Amazon Ads account so you can manage campaigns through plain-English instructions. To connect directly to the Amazon Ads MCP Server, you need authorized access to Amazon Ads, the required Amazon Ads API access for the integration, and an MCP-compatible AI client or agent. Advertisers using an API-integrated third-party platform do not necessarily need to apply for their own Amazon Ads API credentials. The setup has 7 steps: (1) Create a Login with Amazon (LwA) security profile; (2) Apply for Amazon Ads API access; (3) Link the LwA profile to your API application; (4) Collect your four credentials (Client ID, Client Secret, Refresh Token, Profile ID); (5) Install an MCP client; (6) Configure the Amazon Ads MCP Server in your client; (7) Run the OAuth flow and test with a read-only query. Setup time varies depending on whether Amazon Ads API access already exists, the MCP client being used, and the authentication method. Amazon requires an application and approval process for new Amazon Ads API access, but does not specify a guaranteed approval timeline. Always start with a read-only query to verify the connection before enabling writes. A mismatch between an MCP result and Campaign Manager should be investigated. Possible causes include the selected advertising profile, marketplace or region, date range, reporting configuration, attribution settings, or data freshness. |
Most Amazon sellers who hear about MCP have the same first reaction. It sounds amazing: type a question in plain English, and your AI assistant pulls campaign data, adjusts bids, and pauses keywords. No more dashboard exports. No more waiting for a developer. Then they look up how to set it up, and their second reaction is: this looks terrifying.
The documentation is written for engineers. The tutorials involve JSON configuration files, terminal commands, and OAuth flows. The assumption, in almost every guide that exists, is that you already know what a refresh token is and why it expires.
You probably do not. And that is completely fine. Most Amazon sellers and marketing managers do not live in developer tools. The setup process is technical, but it is a finite, learnable sequence: not a wall. Once credentials exist, the active setup takes about 60 minutes. The patience-testing part is the 1–2 week wait for Amazon to approve your API access.
This guide walks through every step with plain-English explanations of what each piece is and why it exists: so you can complete the setup yourself, or hand it to someone and actually understand what they are doing.
| The setup is the hard part. Once credentials exist and the connection is made, using Amazon MCP is genuinely conversational: the kind of interaction that is accessible to anyone who can write a clear sentence about what they want. — Meher Patel, Founder & CEO of Hector AI and Amazon Ads Top 20 Global Partner |
What You Need Before You Touch Any Settings
Three Things That Must Exist First
Think of Amazon MCP like a backstage pass to a concert. The concert is your Amazon Ads account. The backstage pass is the MCP connection. But to get the pass, you need three things:
An Amazon account: You need an Amazon identity with the appropriate access to the relevant Amazon Ads account and, where applicable, the Amazon developer or API application used for the integration. The developer portal, the advertiser console, and the MCP server all authenticate through Amazon.
An approved Amazon Ads API application: Amazon Ads API access requires an application and approval process for organizations building direct API integrations. The process varies depending on the type of organization and use case. This is the step most people are surprised by.
A paid subscription to an MCP-capable AI assistant: You need an MCP-compatible client or AI platform. Availability, MCP support, and plan requirements vary by platform and can change over time. This is a real cost item; plan for it before starting.
The prerequisites depend on how you connect to the Amazon Ads MCP Server. A direct integration and a connection provided through an API-integrated third-party platform may have different setup requirements. Start with the API application first, because that is the longest-wait item.
The Four Credentials You Will Get From Amazon
Before we go step by step, it helps to know what you are collecting and why: because the credential names in Amazon's developer portal are not especially self-explanatory. A direct Amazon Ads API integration can involve authentication credentials such as a Client ID, Client Secret, and authorization tokens. An Advertising Profile ID identifies the advertising profile being accessed and is not an authentication credential.
Credential | What It Is | Analogy |
Client ID | Your application's public identifier: Amazon uses it to recognise your integration | Your gym membership number is visible and identifies you |
Client Secret | A private key that proves your application is authorised | Your gym locker PIN: never share it with anyone |
Refresh Token | A long-lived token that generates short-lived access tokens on demand | A yearly gym contract: you use it to renew access automatically |
Profile ID | A Profile ID identifies an Amazon Ads advertising profile that the authorized integration can access | Your specific gym branch: which location (account) you're checking into |
You will use all four during the setup. Store them somewhere secure immediately: not in a shared Google Doc, not in an email draft. A password manager works well.
The 7-Step Amazon MCP Setup Walkthrough
Step 1 · Create a Login with Amazon (LwA) Security Profile |
Go to developer.amazon.com and log in with your Amazon account. On the top navigation bar, click Login with Amazon. Then click Create a New Security Profile. |
You will be asked for three things: a security profile name (anything descriptive works: "My Amazon Ads MCP" is fine), a security profile description (a sentence about what this is for), and provide the valid application information and privacy-related URLs required by Login with Amazon and Amazon's application-registration process. |
After creating the profile, the page shows a table with your Client ID and gives you access to your Client Secret. Copy both and save them now: the Client Secret is harder to retrieve later. |
On the same page, find the Allowed Return URLs section. Configure the redirect or callback URI required by the authentication flow or MCP client you are using. The URI must exactly match the authorized redirect URI configured for that application. This is the local address the MCP server uses to complete the OAuth authorisation later. If this URL is even slightly wrong, you will get an 'Invalid redirect URI' error at Step 7. |
Watch out: Copy the Client ID and Client Secret immediately. The Client Secret is only clearly visible once. |
Step 2 · Apply for Amazon Ads API Access |
This step happens in a completely different portal from Step 1. Request Amazon Ads API access through the applicable Amazon Ads API registration path for your organization. Amazon provides different access paths depending on whether you are a partner building applications for others or a direct advertiser building an integration for your own advertising account. |
Fill in the application. You will be asked for your business details, the use case for API access, and confirmation that you agree to Amazon's API terms. The application is straightforward: describe your use case honestly (campaign reporting, bid management, automation). |
Amazon reviews applications manually. Expect 1–2 weeks for approval. While API access is being reviewed, you can prepare your MCP client and other prerequisites. Complete API-specific authorization and configuration once the required access is available. |
Step 3 · Link Your LwA Profile to Your Ads API Application |
Once your API access is approved (you will receive an email confirmation), go back to advertising.amazon.com and navigate to your API settings. |
Find the LwA credentials section and select the security profile you created in Step 1. Do not look for this in the developer console: it lives inside your actual Ads console. |
This step connects the two halves of the authentication chain: the LwA security profile (which issues tokens) and the Ads API application (which defines what those tokens can access). |
Step 4 · Collect Your Four Credentials |
You now need to obtain a Refresh Token and your Advertising Profile ID: the two credentials you do not have yet. |
To get the Refresh Token, run an OAuth authorisation flow using your Client ID, Client Secret, and the allowed return URL from Step 1. The exact method depends on your setup: some MCP clients handle this automatically in Step 7; others require running a short script or using a tool like Postman. The flow sends you to Amazon's login page, you grant permission, and Amazon returns a Refresh Token to your redirect URL. |
Use the Amazon Ads Profiles API or the corresponding supported account/profile discovery capability to identify the Advertising Profile ID available to the authorized user. The number in the URL is your Profile ID. Alternatively, once the MCP connection is live in Step 7, you can ask the AI to list your profiles. |
You should now have all four credentials. Collect them in one secure place before proceeding. |
Watch out: Never store credentials in plain text files, emails, or shared documents. Use a password manager. |
Step 5 · Install an MCP Client |
An MCP client is the AI tool that will talk to Amazon's server. The most widely used options are Claude Desktop and Claude Code (from Anthropic), both of which support MCP natively. ChatGPT with MCP configuration enabled and Gemini are also options. |
Download and install whichever client you are using from its official source. If you are using Claude Desktop, go to claude.ai/download. Make sure you are on a paid plan: free tiers do not support MCP connections in most cases. |
If your team already uses one AI tool regularly, start with that one. Connection and authentication steps vary by MCP client. Follow the current setup instructions for the specific client you are using. |
Step 6 · Add the Amazon Ads MCP Server and Configure Credentials |
This is where the pieces come together. The method used to add the Amazon Ads MCP Server depends on the MCP client. Some clients use configuration files, while others provide settings or connection interfaces for remote MCP servers. |
For Claude Desktop, the configuration file lives at ~/Library/Application Support/Claude/claude_desktop_config.json on Mac, or at the equivalent Windows path. Open it with a text editor. |
Configure the Amazon Ads MCP Server using the connection and authorization method supported by your MCP client and Amazon's current MCP documentation. The exact structure is documented in Amazon's official MCP setup guide at advertising.amazon.com. Paste carefully: JSON is sensitive to missing commas and brackets. |
Save the file and restart your MCP client. |
Watch out: If the client does not show Amazon tools after restarting, check the JSON syntax first. One misplaced comma will silently break the entire config. |
Step 7 · Authorise the Connection and Run Your First Read-Only Query |
Open your MCP client. If the selected MCP client uses an interactive OAuth authorization flow, it may open a browser and ask the user to authenticate and authorize access. The exact authorization experience depends on the client and integration method. |
Think of this like the first time you use a hotel key card. The card has been programmed (the credential is in the config), but you still need to activate it at the front desk (the OAuth flow) before it will open your room. |
Once you approve the connection, you are ready. Before you do anything else, run a read-only query to confirm everything is working. A good first test is: "Show me my campaign spend for last week." Compare the number that comes back against Campaign Manager. |
If the result differs from Campaign Manager, verify the advertising profile, marketplace or region, date range, metric definition, attribution settings, and reporting freshness before concluding that the connection is incorrect. Try typing "List my available profiles" to see all connected accounts, then set the correct one. |
Watch out: Do not run any write actions (bid changes, pauses, campaign creation) until you have confirmed the read-only data matches Campaign Manager. One missed mismatch at this stage can mean changes landing on the wrong account. |
Common Errors and How to Fix Them
Invalid Redirect URI
This appears during the OAuth flow and means the callback URL in your LwA security profile does not exactly match what the MCP server is sending. The fix: go back to developer.amazon.com, open your security profile, and check the Allowed Return URLs section. Configure the redirect or callback URI required by the authentication flow or MCP client you are using. The URI must exactly match the authorized redirect URI configured for that application.
Wrong Profile Connected
The AI is answering questions about the wrong Amazon Ads account. This happens when your credentials map to multiple advertising profiles (common for agencies or accounts with multiple marketplaces). Ask the AI: "List all my available advertising profiles." Identify the Profile ID for the account you want to work with and explicitly set it in the session.
Token Expired Mid-Session
Refresh Tokens are long-lived but not eternal. Access Tokens (the short-lived tokens derived from your Refresh Token) expire after about an hour. Most MCP clients handle this rotation automatically, but Authentication errors should be handled according to Amazon's authorization flow and the MCP client's documented token-refresh behavior. Manage and store refresh tokens according to Amazon's current authorization documentation and your integration's credential-management requirements.
What to Do After Setup
The Safe Way to Expand From Read-Only to Write Access
For risk-sensitive implementations, consider validating read operations before allowing campaign-management actions. The duration and testing process depend on your organization's controls and use case. During that week, ask questions about your account: spend summaries, keyword performance, which campaigns are near their daily budget cap, and cross-reference the answers against Campaign Manager. Build a baseline of trust in what the connection returns.
Before allowing campaign changes, confirm that the authorized Amazon Ads user or application has the intended permissions Start with read-only verification on your Sponsored Ads campaigns before enabling any write access and test the connection with low-risk operations. Verify the pause happened. Verify nothing else changed. Only expand the scope of write actions as you verify each one.
Write-Access Staging Approach Week 1-2: Read-only. Verify every number against Campaign Manager. Week 3-4: Single low-spend campaign, bid changes only. Confirm each change before proceeding. Month 2+: Scoped writes with clear limits (e.g. maximum 15% bid change, $20 budget floor). Review the change log daily. Always log what the AI changed and what the previous value was. An action you cannot reconstruct is an action you cannot reverse. |
Keeping Credentials Secure
Your Client Secret and Refresh Token are long-lived sensitive credentials. Treat them with the same care as a bank password. Store them in a proper credential manager (1Password, LastPass, or AWS Secrets Manager if your team uses AWS). Never commit them to a code repository. Never paste them into a shared document.
Platforms like Hector Ai handle API credential management as part of their infrastructure: the MCP integration is built around these guardrails by default, but if you are self-hosting your MCP connection, the credential security is entirely your responsibility.
_1788776488220.webp?w=256&q=75)