Getting started

Amazon Data API authentication

One key, one header. No OAuth dance, no token refresh, no expiry to schedule around.

Key format

Keys look like this. The prefix tells you which environment a key belongs to at a glance:

Key anatomy
ac_live_4f8a91c07b2e5d63a1f04c8b7e29d5a6c3b81f0e9d7a2c45
└──┬───┘└─────────────────────┬────────────────────────┘
   │                          │
   environment              48 hex characters (24 random bytes)

ac_test_…  # same shape, for staging and CI

Sending the key

Both headers are accepted and behave identically. Use whichever your HTTP client handles best.

Two equivalent forms 
curl "https://amazoncrawler.com/v1/products/details?asin=B07CMS5Q6P" \
  -H "x-api-key: ac_live_your_key"

curl "https://amazoncrawler.com/v1/products/details?asin=B07CMS5Q6P" \
  -H "Authorization: Bearer ac_live_your_key"
An api_key query parameter is also accepted as a last resort for clients that cannot set headers. Avoid it in production — query strings end up in proxy logs, browser history and referrer headers.

How keys are stored

We keep a SHA-256 digest of your key, plus its prefix and last four characters for display. The key itself is shown exactly once, at creation. That means we genuinely cannot recover it for you — and equally, a breach of our database hands out nothing usable.

Environments

PrefixUse forCredits
ac_live_ Production traffic. Charged against your monthly quota.
ac_test_ CI, staging and local development. Also charged — keep an eye on chatty test suites.

Separate keys per environment mean you can revoke a leaked CI key without touching production.

Rotation without downtime

Because multiple keys can be active at once, rotation never needs a maintenance window:

  1. Create a new key in the dashboard.
  2. Deploy it to your application.
  3. Confirm traffic is flowing on the new key — the keys page shows last-used time per key.
  4. Revoke the old one.

Revocation is immediate. Requests using a revoked key get 401 unauthorized from the next call onward.

Keeping keys out of your repo

.env
AMAZONCRAWLER_API_KEY=ac_live_your_key_here
app.py
import os

KEY = os.environ["AMAZONCRAWLER_API_KEY"]  # fails loudly if unset
HEADERS = {"x-api-key": KEY}

Authentication errors

StatusCodeCause
401unauthorizedNo key sent, or the key is unknown or revoked.
403forbiddenKey is valid, but your plan does not include that endpoint group, or the subscription is inactive.
401 response
{
  "error": {
    "code": "unauthorized",
    "message": "Missing API key. Send it as `x-api-key: ` or `Authorization: Bearer `.",
    "status": 401
  }
}

Get an API key →