Skip to content

Amazon Pay API Token

Service Name: Amazon Pay

Service Description: Amazon Pay is a payment service that lets customers use the payment methods stored in their Amazon accounts to pay for goods and services on third-party websites, apps, and voice-enabled devices.

Service Address: https://pay.amazon.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured in the Amazon Pay merchant account settings

Secret Access Scope: Grants access to Amazon Pay APIs for processing payments, managing refunds, retrieving transaction details, and accessing customer payment information.

Secret Revokement URL: https://pay.amazon.com/us/developer/account/keys

Secret Example: amzn1.application-oa2- client.a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Suspicious Activity Investigation Instructions:

  • Review Amazon Pay transaction logs for unauthorized payment processing
  • Check for unusual transaction patterns or volumes in your merchant account
  • Monitor for unexpected refunds or payment cancellations
  • Verify API call logs for unauthorized access attempts
  • Examine integration points for potential security breaches

Mitigation Instructions:

  • Log in to your Amazon Pay merchant account

  • Navigate to the Integration > Keys section

  • Locate the compromised API key

  • Click "Deactivate" to immediately revoke access
  • Generate a new API key with appropriate permissions
  • Update your application with the new key
  • Review and update your security practices to prevent future exposures
  • Consider implementing IP restrictions for API access
  • Enable multi-factor authentication for your Amazon Pay merchant account