How do I make the Amazon SP-API Migrating sellers instructions work

Question

We have a long running MWS application that we migrated to use the new SP-API interface. We have done most of our work in the sandbox environment and have been trying to migrate our existing customers over. The instructions at this website seem simple enough but step 3 is resulting in an unauthorized response. This includes both our personal amazon seller account and our current customers amazon seller accounts. I have been using PostMan for testing the process of migrating accounts before moving it to our c# process.

I am at an actual loss of what it could be. We created our IAM Roles and user according to these instructions: https://developer-docs.amazon.com/sp-api/docs/creating-and-configuring-iam-policies-and-entities

I then did the migration process according to these instructions: https://developer-docs.amazon.com/sp-api-blog/docs/migrate-seller-authorizations-from-mws-to-sp-api

Step 1 and Step 2 work as expected but getting the temporary token at step 3 results in the following error response

{
"errors": [
    {
        "message": "Access to requested resource is denied.",
        "code": "Unauthorized",
        "details": ""
    }
]
}

I have made the step 3 connection from both the instructions by hand and using the model as supplied by https://github.com/amzn/selling-partner-api-models/tree/main/models/authorization-api-model

Answer 1

I guess you have a public application and make sure you add a developer id in the seller application. Share more detail to resolve your issue, as I have migrated 10+ app and its work smoothly.

Answer 2

You mean the access token? To get the access token, you need LWA credentials, these consist of a "Client identifier" (amzn1.application-oa2-client.ed722....) and a "Client secret" (a2873b4.......). And a refresh token that you can get by Action->Authorize. You can find these in the seller account, "Partner Network"->"Develop Apps"

As to get the access token in Postman:

POST https://api.amazon.com/auth/o2/token

In Body -> x-www-form-urlencoded

grant_type :: refresh_token
refresh_token :: Atzr|IwE.... (the refresh token u got when u clicked on "Authorize" on your app)
client_id :: amzn1.application-oa2-client.ed752....
client_secret :: a2953b4......

As a result, you should get:

{
"access_token": "Atza|IwEBIKJpxfB....",
"refresh_token": "Atzr|IwEBIM9QsQUPTJ....",
"token_type": "bearer",
"expires_in": 3600
}

The access token is the temporary token that you're talking about No idea what the refresh token does since its not the same as the one you enter but i never had to use it. By the way, if you used an iAM Role as your IAM ARN, you have to use STS Credentials (ASIA3SXMG.....), if you used an iAM user as your IAM ARN, you can use AWS credentials, (AKIA3SXMG....)