How to Set Up Amazon Ads MCP: A Step-by-Step Guide

Setting up Amazon Ads MCP comes down to two things: getting access to your Amazon Ads data, and connecting that to an MCP-capable AI client. How much work the first part takes depends entirely on which route you pick.

Two ways to connect

Fastest

Managed server

A third-party provider runs the server and holds your tokens.

• Handled for you Amazon Ads API access and token refresh
• You do Authorize your account once, then connect
• You do Start using it in minutes

Full control

Official or self-hosted

You connect Amazon's server, or run your own.

• You do Register for Amazon Ads API access
• You do Hold and secure the credentials
• You do Set up and maintain the connection

Before going further, it helps to know there are three kinds of Amazon Ads MCP server, because the word “managed” trips people up:

• Managed servers are run by third-party software providers, such as Adbrew MCP, Intentwise MCP, or Hector MCP. The provider already holds Amazon Ads API access, so you just sign in, authorize your account, and start in minutes. These usually add guardrails and logging on top.
• Amazon’s official server is Amazon’s own first-party MCP server. It is capable, but you bring your own Amazon Ads API credentials and connect it yourself.
• Self-hosted servers are open-source projects you run on your own machine or cloud. Maximum control, but you handle the credentials, hosting, and upkeep.

The managed route is easiest because the provider takes care of the API access described below. The official and self-hosted routes need your own Amazon Ads API access, which is what the rest of this guide walks through.

What you need first

• An Amazon Ads account with active campaigns. Amazon will not approve API access for an account with no ad spend.
• An MCP-capable AI client, such as Claude or ChatGPT.
• For the official or self-hosted route, Amazon Ads API access, set up below.

Getting Amazon Ads API access

This is the part most guides gloss over. Here is the whole path, start to finish.

1. 1
   Request Amazon Ads API access Apply through the onboarding portal and wait for review.
2. 2
   Create a Login with Amazon security profile This gives you the Client ID and Client Secret.
3. 3
   Link the security profile to your API application Done in the Ads console, not the developer portal.
4. 4
   Run the OAuth flow Authorize once to get a long-lived refresh token.
5. 5
   Select your profile Choose the account and marketplace to manage.

Request access and wait for approval

1. Go to the Amazon Developer portal.
2. Sign in using the exact email address tied to your main Seller or Vendor account. Using a different login is a common cause of access headaches later.
3. Complete the standard developer registration if you have not done so before.
4. Open the Amazon Ads API onboarding guide and click Request Access.
5. Fill out the application form: enter your company name, choose “I want to manage my own advertising” as the use case, and select the markets you advertise in.
6. Submit the form and wait. Approval typically takes one to three business days.

If you are rejected, the usual reason is an account with no active ad spend. Make sure campaigns are running, then reapply with a clear description of what you plan to do.

Create a Login with Amazon security profile

The Amazon Ads API authenticates through Login with Amazon (LWA). In the LWA console:

1. Create a new security profile and give it a name and description.
2. Copy your Client ID, which begins with amzn1.application-oa2-client.
3. Copy your Client Secret, which begins with amzn1.oa2-cs.v1. Keep both somewhere secure.
4. Add an allowed return URL (the redirect URI). It has to match exactly what your server expects, or authorization will fail later. For a locally hosted server it is usually a localhost callback such as http://localhost:8000/auth/callback; for a hosted server it is your domain’s callback URL.

Link the profile to your API application

This is the step people miss.

1. Open your Amazon Ads console, not the developer portal.
2. Find the API or LWA settings.
3. Link the security profile you just created to your approved Ads API application.

If you skip this, authorization will appear to succeed in the browser, but your client will report that it is not authenticated.

After approval, what you actually have

Once the above is done, you hold five OAuth credentials rather than a single API key:

Credential	What it is
Client ID	Identifies your application
Client Secret	The application’s secret
Refresh token	Long-lived token used to mint access tokens (from the OAuth flow)
Access token	Short-lived token sent on each API call
Profile ID	The advertiser account and marketplace to act on

The Amazon Ads API supports only the authorization-code flow with refresh tokens. There is no static key, which is exactly why managed servers, which hold and rotate these for you, remove so much of this work.

Connecting your AI client and running OAuth

With access in place, point your client at the server. Most MCP clients need only the server URL. A remote-server config block looks like this:

{
  "mcpServers": {
    "amazon-ads": {
      "type": "streamable-http",
      "url": "https://your-amazon-ads-mcp-server.example/mcp"
    }
  }
}

After the client reconnects, you complete the OAuth flow to turn your approved access into a working session. With most servers you do this in conversation: ask the assistant to start the OAuth flow, open the URL it returns, approve access, then confirm the status. That step is what produces your refresh token and logs the server into your account.

Finally, select a profile. A profile is one account in one marketplace, so your US and Canada stores are separate profiles. List your profiles, then set the active one before running any reporting or campaign tools.

Client-specific walkthroughs with the exact prompts:

• Connect Amazon Ads MCP to Claude
• Connect Amazon Ads MCP to ChatGPT

Validate before you trust it

1. Run a read-only report and confirm the figures match the Amazon Ads console.
2. Make one tiny write, such as a small budget change, and confirm any guardrails behave.
3. Check the action log so you can see exactly what the AI did.

Common setup problems

• API access rejected. Almost always no active ad spend. Run campaigns and reapply with a detailed use case.
• “Invalid redirect URI.” The allowed return URL in your LWA profile does not match what the server expects. Make them identical.
• Browser shows success, but the client says not authenticated. Your LWA security profile is not linked to your Ads API application. Link it in the Ads console and retry.

Go broader

Once you trust read accuracy and write behavior, expand into real workflows. For ideas, see Amazon Ads MCP use cases. To understand what happens behind each call, read how Amazon Ads MCP works.

Related reading

• New here? Start with What is Amazon Ads MCP?
• The first-party option: the official Amazon Ads MCP Server

Sources

1. Amazon Ads, “Onboarding overview” (requesting API access, review). advertising.amazon.com
2. Amazon Ads, “Assign API access to a Login with Amazon application” (linking the security profile). advertising.amazon.com
3. Amazon Ads, “Amazon Ads API authorization overview” (Login with Amazon, authorization-code flow). advertising.amazon.com