Skip to main content
Markifact supports two ways to connect Amazon Ads: using the built-in Markifact app (Quick Connect) or connecting through your own Login with Amazon app (Custom App). With a custom app, every request Markifact makes to the Amazon Advertising API runs under your app and your client ID, so your clients never see Markifact.
Custom app connections are available on the Team plan. See White-label Connections for the overview.

​
Quick Connect vs Custom App

​
What You Need

Three values from your own Login with Amazon app: Amazon access tokens last one hour; Markifact refreshes them with your client ID and secret on every run. Refresh tokens stay valid until the user revokes the app.
Amazon rejects any Advertising API call whose Amazon-Ads-ClientId header does not match the app that issued the token, which is why Markifact stores the client ID alongside the refresh token and sends them together.
Already have your own authorization flow? If your systems already hold a refresh token issued by your app with the scope below, skip to Connect to Markifact.

​
Setting Up Your Custom Amazon Ads App

1

Create the Login with Amazon Security Profile

  1. Open the Login with Amazon console and click Create a New Security Profile
  2. Enter the profile name, description, and a privacy policy URL. The profile name is the branding users see when they authorize
  3. Once created, open Web Settings and add a Allowed Return URL you control (for example https://www.youragency.com/amazon-callback). Amazon appends the auth code to this URL after authorization; the page does not need to do anything, but the URL must be HTTPS
  4. Copy the Client ID and Client Secret
2

Apply for Amazon Advertising API Access

The Advertising API is not open to every app. Apply through the Amazon Advertising API onboarding and wait for Amazon to allow-list your client ID. Agencies that already run their own integrations will have this in place; until it is approved, the profiles endpoint returns authorization errors.
3

Authorize and Get the Auth Code

  1. Open the following URL in a browser, replacing the client ID and return URL. Use the regional login host that matches your advertiser: amazon.com for North America, eu.account.amazon.com for Europe, apac.account.amazon.com for the Far East
  1. Sign in as the Amazon account that has access to the advertising accounts you want to manage and click Allow
  2. Amazon redirects to your URL with code=... in the query string. Copy the value. Auth codes expire after a few minutes and can be exchanged once, so do the next step right away
4

Exchange the Auth Code for a Refresh Token

Run this request, replacing the values (the redirect URI must match the one used above exactly):
The response contains refresh_token. Copy it.
Important: Keep this token secure. Anyone holding it, together with your client ID and secret, can act on every advertising account the user can reach.
5

Connect to Markifact

  1. In Markifact, go to the Connections page
  2. Click Connect on Amazon Ads
  3. Select the Custom App (White-label) tab
  4. Enter a Connection Name (for example “Acme Agency Amazon Ads”)
  5. Paste your Client ID, Client Secret, and Refresh Token
  6. Click Verify & Connect
Markifact refreshes the token once with your app, then reads the advertising profiles from the North America, Europe and Far East endpoints. Nothing is saved unless at least one region returns a profile.

​
Selecting Your Connection

Custom app connections appear under the name you chose, with a Custom app badge on the Connections page. Select them in Amazon Ads nodes, agents, and MCP exactly like any other Amazon Ads connection, then pick the advertising profile in the node.

​
Rotating or Replacing the Token

Add the connection again with the same connection name and the new values. Markifact replaces the stored credentials in place, so workflows and agents bound to the connection keep working.

​
Troubleshooting

Check both values on your security profile in the Login with Amazon console. The client ID starts with amzn1.application-oa2-client..
The token was issued by a different security profile than the one whose client ID you pasted, or the user revoked the app under their Amazon account’s Login with Amazon settings. Authorize again and paste the new refresh token.
The client ID and the refresh token must come from the same app. Amazon checks the Amazon-Ads-ClientId header against the token’s issuing client and rejects a mismatch, so pasting a client ID from one security profile with a token from another always fails here.
Your client ID has not been allow-listed for the Advertising API yet, or the token is missing the advertising::campaign_management scope. Check the onboarding status with Amazon and authorize again with the scope.
The account that authorized has no access to an advertising account. Invite it under Account settings > User management in the Amazon Ads console, then authorize again.

​
Summary

White-label Connections

Overview of custom app connections across channels

Get Report

Pull Amazon Ads performance data