Seller Central User Permissions: What to Grant an Outside Amazon Operator, and What Expires

Twelve months into an Amazon engagement is when access tends to break. Not on day one, when everybody is paying attention and somebody is sharing a screen. A year in, when the person who set it up has changed roles and the only sign anything happened is that a report stopped arriving.

That isn't a glitch. It's how the permission model works, and most brands meet it by accident. Seller Central user permissions are really three separate systems wearing one name, each with different scope and different expiry behaviour. We've set this up inside 100+ brands, and the ones who get it right treat account access as a clause in the operating agreement rather than an admin task somebody squeezes in on a Friday afternoon.

Three kinds of Amazon account access, and they aren't interchangeable

Grant the wrong one and your operator either can't do the job you hired them for, or can do considerably more than you meant to allow. Amazon offers three distinct paths.

Access type	Who it's for	How it's granted	Does it lapse?
Primary user	The account owner. One per account.	It's the account's registered login.	No.
Secondary user	A named individual, usually an employee or a direct contractor.	Settings, then User Permissions, by invitation to an email address. Professional selling plan only.	No. It stays until somebody removes it.
Authorized partner or service provider	An agency, a fractional operator, or a software tool.	Role-based authorization, scoped to the roles Amazon has approved for that provider.	Yes. Public applications have to be reauthorized by the selling partner roughly every year.

Amazon's own seller forum guidance points external contractors at the authorized-partner route rather than adding them as secondary users, and that's the right default for a firm. A secondary user is a person. An agency is an organization with staff turnover, and a named seat tied to one individual's inbox becomes a problem the first time that individual leaves.

So if you're bringing in a fractional Amazon manager to own the channel week to week, the access conversation is the first real decision of the engagement. Not paperwork after the contract is signed.

What does a secondary user actually get in Seller Central?

A secondary user gets exactly what you grant them, area by area, at one of three levels: none, view only, or view and edit. The controls sit under User Permissions, where you can set each section of the account independently or apply a setting across the board through the global permissions view.

Two details catch people out. Secondary users require a Professional selling plan, so an Individual account has no path to this at all. And a secondary user can only see and change the User Permissions page itself if you've given them administrative rights, which also lets them manage everybody else's permissions. That second one matters more than it sounds, and it's the subject of a later section.

Use a fresh email address that isn't already attached to another Amazon account. An address that's tied to a buyer account or a second seller account will fail the invitation in ways that are tedious to unpick.

Why does Amazon account access expire after about a year?

Because a provider authorization is a token rather than a password. Amazon's developer documentation requires the selling partner to reauthorize a public application every 365 days, and again whenever a new role is added to that application. Refresh tokens carry the same 365-day lifetime. Nothing about that is unusual for an API, and it's good security practice.

The operational consequence is the part worth planning for. Roles are approved per provider through Amazon's Solution Provider Portal, which means an application can hold an authorization and still be missing the specific role a given task needs. Where that happens the API returns a 403, and a 403 doesn't reach you as a warning banner. It reaches you as a number that stopped updating, or a report that came back thinner than last month's.

Which brings us back to month twelve. The expiry is predictable, the email announcing it is easy to miss, and the failure is silent. Put the reauthorization date in a calendar on your side of the relationship, and check pending requests inside Seller Central under User Permissions rather than clicking through from the email, which is also the safer habit against phishing.

The access most brands hand over too quickly

Full administrative rights. It's the fastest possible answer and we understand the appeal, because scoped access genuinely creates friction and the first few weeks of an engagement are when friction is most expensive.

Be clear about the trade though. An administrator can add and remove other users, change account-level settings, and alter the details that money moves through. Your audit trail also stops being able to separate their actions from your own, which you'll care about on the day you need to reconstruct who changed a price or who closed a case.

A better structure costs very little. Keep the primary user and at least one administrator on your side, permanently. Grant your operator the scopes the work needs and nothing above them. Review it quarterly, which takes about ten minutes.

The honest counterpoint: every scope you withhold becomes a request that lands back on your desk. Some of those are trivial. A few of them genuinely stop work, and three in particular are usually worth granting outright rather than rationing.

Which permissions an operator genuinely needs to run the channel

1. Advertising. Non-negotiable. Bid and budget decisions can't be made through a request queue, and an operator who can only recommend changes is a consultant, not an owner.
2. Inventory and FBA. Replenishment and restock decisions are time-boxed by Amazon's own capacity windows. Delay the decision and the window closes.
3. Catalog and listings. Edit rights, not view. Listing fixes are the cheapest conversion work available and they lose their value if they queue.
4. Account health and the case log. The one brands forget. Policy notices and suppressed listings have clocks on them, and somebody has to be able to file and escalate, not just read.
5. Business reports. Read access is enough here. This is the diagnostic layer.
6. Brand tooling. A+ content, Brand Store and brand protection features, if the brand is enrolled. Separate from Seller Central permissions in places, so check it explicitly rather than assuming it came along with the rest.

Finance and bank details belong on your side of the line. So does adding users. Neither is channel work.

Reporting access and decision authority are not the same thing

Across our client portfolio the pattern is consistent: the work that moves the number is the work that requires authority, not just visibility. When we took on Kizik, unauthorized sellers were holding the Buy Box for most of the day and the brand was losing the customer relationship on its own listings. The fixes were channel restrictions, restriction notices to the sellers already on the listings, cutting off the distributors supplying them, and enforcing a MAP policy with consequences attached.

Not one of those actions is possible from a view-only seat. Buy Box placement rose 81% over four months. The full Kizik case study sets out the sequence, and the access structure is why it could run at that pace. If rogue sellers are your version of this problem, our unauthorized seller removal work starts from the same place.

What to settle before the handover

1. Name the administrator who stays on your side of the account. One person, written down.
2. Choose the authorized-partner path for a firm and the secondary-user path for a named individual. Don't mix them because the invitation was quicker.
3. Agree the scope list before the kickoff call, using the six items above as the starting draft.
4. Decide explicitly who files and escalates cases, because that one gets assumed by both sides and done by neither.
5. Diary the reauthorization date the day access is granted. A year is long enough to forget.
6. Write the offboarding step into the agreement now, while everybody is friendly.

If you want the broader shape of the first few months rather than the access mechanics alone, what actually happens in the first 90 days covers the rest of the handoff.

A short note on tools

Everything above applies to software as much as to people. Every repricer, analytics platform and automation tool connected to your account holds a provider authorization with its own role scope and its own expiry. Most brands we audit are carrying at least one connection nobody can account for, usually from a trial that was never revoked. Read that list once a quarter and revoke what you don't recognize. It's the cheapest security work available on the channel.

The real signal

Access isn't administrative trivia. It's the first honest test of whether you're hiring someone to report on the channel or to run it, and the answer shows up in which permissions they ask for before you've asked them to. An operator who wants the case log and the advertising console is planning to make decisions. One who asks for business reports and stops there is planning to send you a monthly deck.

If you want the first kind, book a call and we'll walk the scope list before anything gets granted.