Agent access security model

Amazon credentials

Amazon issues refresh tokens to Agentic Sellar when you authorize Seller Central or Amazon Ads. They are encrypted at rest with AES-256-GCM, used only on Agentic Sellar’s servers, and never returned to an AI client, API caller or browser.

OAuth for AI clients

• Clients use the OAuth 2.1 authorization code flow with PKCE (S256) and register through dynamic client registration. Client names are self-reported, so the consent screen shows the client’s callback host.
• Authorization codes are single-use, expire after 5 minutes, and are bound to the client, the exact redirect URI, the resource and the PKCE challenge.
• Access tokens expire after 60 minutes. Refresh tokens rotate on every use; presenting an already-used refresh token revokes the whole grant.
• Authorization codes, access tokens and refresh tokens are stored only as hashes.
• An invalid or expired bearer token is rejected outright; it never falls back to a browser session.

Transport and request checks

• The MCP endpoint validates the Host header and any browser Origin against Agentic Sellar’s own origin. Server-side and desktop clients are supported; arbitrary cross-origin browser clients are not.
• Request bodies are size-limited and every tool input is validated against a strict schema.
• Tool calls that reach Amazon accounts are limited to 120 a minute per workspace, shared by all of its AI connections, in addition to plan concurrency and monthly work-unit limits. Discovery calls are limited per connection, and client registration is rate-limited separately.

Call receipts

Every tool call that passes authentication, scope, account and plan checks records a receipt with the operation, the Amazon account, the outcome and the time. Receipts deliberately exclude report contents and tokens. You can see recent calls for the connections you authorized under Settings → Agent access.

Prompt injection and untrusted content

Amazon data can contain text written by other people, such as listing copy, reviews or customer search terms. Treat it as content, not instructions. Agentic Sellar limits what a misled AI client can do: writes need a write scope and explicit confirmation, are labelled as destructive so your client can ask you first, and only reach the accounts in the grant. Review proposed changes before approving them, and revoke connections you no longer use. For a seller-focused comparison of access methods and a checklist you can apply to any tool, read how to give an AI agent access to Amazon without sharing credentials.

Reporting a vulnerability

See the security and vulnerability disclosure policy for how to report an issue and what to expect from us.