The Secret Key of Amazon

With the release of version 4.2.0 for Associate-O-Matic, we move into a new phase. One of the landmark changes in this upgrade is a head start on Amazon’s requirement for increased security and more accountability. In order to reduce the number of server calls and general abuse of the system (which make it run slower and less efficiently for everyone), all requests for the data feed (API) must be accompanied by two keys to identify the user. Server calls after August 15th, 2009 without the keys will be refused.

The upshot of this requirement for AOM users is that after this date, all previous versions of AOM will no longer function. You must update to V4.2.0 or later in order to continue using Associate-O-Matic. Since more casual users of the software may wake up on the 16th to find their stores dead in the water, this post will explain the process of getting the Amazon API keys needed to keep your sites active.

It’s actually a very simple procedure. I will assume that if you are reading this, then you already have an Amazon Associate ID. So to begin, log in to the Associate site (where you check your sales reports). Note the blue tabs at the top of the page:

Click on the Product Advertising API tab. This will take you to a second screen:

If you have not signed up for API keys before, click on the Sign Up Now button located on the right side of the page. This will lead you through the signup procedure (if you are already signed up for keys, scroll down this page until you see the Manage Your Account link).

You will then be asked to log in again. This will take you to another screen which shows your contact information, asks you about the website you plan to use the API keys with, and a copy of the API License agreement which you are required to read and agree to. Once you do this, you’re pretty much approved. It’s a process very similar to the one you followed to become an Amazon Associate in the first place.

Eventually, you wind up here:

Which is the Manage Your Account page alluded to previously. The area you want at this point is Access Identifiers. Click where indicated. This will take you to the page where you can actually get your keys:

Note that there is a public and a secret key involved. The public key is generally not encrypted when included in a server call to Amazon. The secret key however, should always be encrypted. Amazon takes great pains to point out that you should never divulge your secret key to anyone. If you feel your secret key has been compromised, you can generate a new one, as shown in the image above. Plus, if you have sites in different countries (such as the US and UK), you can use the same keys in all your sites, unlike Associate IDs themselves, which are country-specific.

And that’s how you obtain your Amazon API keys. You would then copy and paste these keys into the appropriate boxes in your AOM Control Panel, under the Amazon tab:

Click on the save button, and you should be good to go. I should mention at this point that sometimes as Tech Support, we might need access to your Control Panel. This could mean logging into your admin.php file (with your permission of course; we don’t have access unless you give us the login details). Or we may request a copy of your cfg.saved.php settings file.

If so, we will not have access to your secret key. The key is encrypted in a separate file, just like your Username and Password. Also as you can see from the image above, the characters of the secret key are replaced by asterisks. We can’t see your key, nor do we need to.

Another point to mention is that included in the API license you had to agree to in order to get the keys, is a mention of requiring the following on every page of your AOM site:

CERTAIN CONTENT THAT APPEARS ON THIS SITE COMES FROM AMAZON SERVICES LLC. THIS CONTENT IS PROVIDED ‘AS IS’ AND IS SUBJECT TO CHANGE OR REMOVAL AT ANY TIME.

This particular version is from Amazon.com; there are slight regional variations for each Amazon locale. You can create an image with this text and display it on your site if you don’t want this to count against your site in terms of duplicate content. This and a few other requirements pertaining to pricing will be built into V4.2.0 and subsequent versions of AOM.

So to summarize:

1. Log into your Amazon Associates account and click on the blue Product Advertising API tab at the top of the page.
2. Click the Sign Up Now button and follow the steps, including agreeing to the API License Requirements.
3. Go to Manage Your Account and click on the link in the Access Identifiers box.
4. Get your public and private keys, then paste them into the boxes under the Amazon tab of your AOM control panel.

And remember that while you can follow this procedure at any time after the release of V4.2.0, any AOM site not upgraded by August 15th, 2009 will no longer be able to access Amazon’s data feed.