Step 1: Getting started

(a) Create a new Amazon account

An Amazon account is required to access the Incentives API Portal to view transactions, notify us of payments, receive account alerts, and manage your API security credentials.

1. US clients: Register in about 30 seconds by clicking here.
2. International clients: Go to amazon.com (or replace '.com' with respective country suffix for international clients). For example, if you want access to the Japan portal, go to amazon.co.jp for your new account.
3. Create a new account for your company using your company email address
   Important: This should not be tied to your personal Amazon account.
Note: You will also need to set an account to be used as an IT Manager user at your organization. This can be the same account created in the previous step, or it can be a separate account if you prefer to onboard with two users (one with regular credentials, and one with elevated permissions to access security-related features in the Portal).

(b) Email your account details to Amazon

Email the following information to incentives-api@giftcards.amazon.com and receive confirmation of your sandbox environment within 24-48 hours.

Click here for an email template to send to the API team.

1. Your Amazon account email address created in part (a) of step 1.
2. Amazon account email address for an IT Manager user account at your organization to be used for security purposes. This should be an IT administrator or someone else who will be handling API credentials and other sensitive settings. It can be the same as the address used in (1).
3. An email alias that we can use for security and system notifications. We will use this address to contact your technical team. This address should be an alias, distribution list, or any other email not tied to any individual user account.
4. Your Partner ID
   Important: If you do not have a Partner ID, you will need to fill out the contact form by clicking the "Create Incentives API account" button above.

---

Step 2: Integrate your application

Integrate your application with one of the features below:

(a) Create a digital gift card

1. Become familiar with the product by reading the developer guide
2. Develop your application using the sandbox environment
3. Create a set of API access keys for Sandbox (see API Access Keys).
4. Test your application in Sandbox using the test plan

(b) Login and Receive

1. Become familiar with the product by reading the developer guide
2. Follow the steps in the developer guide to configure all of the required components
3. Create a set of API access keys for Sandbox (see API Access Keys).
4. Test your application in Sandbox using the test plan

(c) Point of Sale Activation (Web Activation)

1. Become familiar with the product by reading the developer guide
2. Ask your Amazon Account Manager for inactive test card numbers for the test cases. Please ensure you have a PGP encryption tool on your computer to decrypt the test card data file. Share your public key (asc file) along with your request
3. Follow the steps in the developer guide to configure all of the required components.
4. Create a set of API access keys for Sandbox (see API Access Keys).
5. Test your application in Sandbox using the test plan

API Access Keys

Access keys are credentials for your AGCOD API account. You use them to sign your requests to the API, and they consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). Like a user name and password, you must use both the access key ID and secret access key together to authenticate all your requests. Manage your access keys as securely as you do your user name and password for other services.

Managing access keys

You can use the AGCOD credentials page within the API portal to manage your account's access keys.

To create, modify, or delete your access keys

1. Sign into the API portal and open the AGCOD credentials page at US | CA | MX | FR | IT | ES | DE | UK | UAE | TR | JP | AU. | SA | SE | SG | NL | PL

2. Select the environment (Production or Sandbox).
3. In the access keys section, do any of the following
• To create an access key, choose Create new access key and store the Access key ID and Secret access key in a secure location. You will not have access to the secret key again after this dialog box closes. When you create an access key, the key pair is active by default, and you can use the pair right away.
• To disable an active access key, choose Deactivate.
• To re-enable an inactive access key, choose Activate.
• To delete an access key, choose Delete. Select Delete key in the dialog box to confirm. When you delete an access key, it's gone forever and cannot be retrieved. However, you can always create new keys. Only inactive keys can be deleted.
Note! You should only have one active access key at a time, except for when you are rotating your keys.

Rotating access keys

As a security best practice, we recommend that you regularly rotate (change) your access keys. You can do so within the AGCOD Credentials page in the API portal. If you are unable to see the page, please reach out to an administrator at your company because only admin users have access to these features.

Changing access keys on a regular schedule is a well-known security best practice because it shortens the period an access key is active and thereby reduces the business impact if they are compromised. Having an established process that is ran regularly also ensures the operational steps around key rotation are verified, so changing a key is never a scary step for your organization.

We recommend changing your access keys at a minimum of once every 180 days (or 6 months). You will receive an email 30 days before the keys should be rotated as a reminder to initiate the process. If you have questions please contact your account manager or incentives-api@amazon.com.

To rotate access keys, you should follow these steps:

1. Create a second access key in addition to the one in use.
2. Update all your applications to use the new access key and validate that you are able to make successful AGCOD requests.
3. Change the state of the previous access key to inactive.
4. Validate that your applications are still working as expected. Be sure to take care during this step because once an access key is deleted, it cannot be recovered.
5. Delete the inactive access key.

Both access keys will be supported while in the process of rotating.

---