Connect Amazon Ads to Rig

Check you have access

Two separate things have to be true before this connector can read anything, and they fail differently. Check both before you go looking for credentials.

First, that your Login with Amazon application is approved for the Ads API:

1. Sign in to the Developer dashboard with the Amazon Developer account that owns the application.
2. Find your application in the list. The dashboard shows every Login with Amazon application on that account alongside the permission scopes each one holds.
3. Look for advertising::campaign_management. That is the scope the Ads API checks. If your application is not listed, or it is listed without that scope, you do not have working API access yet, whatever an approval email may have told you.

Second, that the account you authorise from can see the advertisers you want. Approval only lets you call the API. Which advertisers you can actually read is decided separately, and one of these has to be true:

• A Manager Account with Admin permission over the advertisers you want. This covers Sponsored ads and DSP, and it is the cleaner option if you have it.
• An ADSP Reports link, for read-only DSP access. In Manager Accounts, go to Accounts → Add account → Link existing account → Request access. The advertiser's admin then approves the emailed request. There is no API for this step: a person has to click it, so start it early.

If you do not have API access yet

1. Go to advertising.amazon.com/about-api and sign in to apply. Use the email address registered to your Login with Amazon account, because the later steps only work when the two match.
2. Fill in the registration form. It asks what your business does and how you plan to use the integration, and you confirm you comply with Amazon's licence agreement and data protection policy.
3. Wait for the invitation email. Direct advertisers are usually approved in around 72 hours. Tool providers and agencies are reviewed more heavily and take weeks.
4. Open the sign-up link in that email, accept the Amazon Ads API terms, then choose your Login with Amazon application to allowlist. This is the step people skip, and skipping it leaves you approved but with credentials that still fail: The LWA client ID is not approved to use the requested scope. Amazon covers the fix under assign API access, and you have to be signed in with the same email you applied with.

Get your credentials

Rig needs three values, and the third is made out of the first two:

• Client ID and client secret, which identify your Login with Amazon application. That is the same object the console calls a security profile, so the two names mean one thing. You copy these out of the console.
• A refresh token, which says whose data that application may read. There is no screen anywhere that shows you one: it is generated by authorising the application against an account, using the client ID and secret to do it.

Get the client ID and secret

1. Sign in to the Login with Amazon console with the Amazon Developer account that owns the approved application.
2. Find your security profile in the table and click the icon in the Manage column.
3. Choose Web Settings.
4. Copy the Client ID. Amazon Ads client IDs start amzn1.application-oa2-client.
5. Copy the Client Secret from the same page. Treat it like a password.
6. Note which region the advertisers sit in: na, eu or fe. The UK is served by eu and the US by na, which catches people out.

Keep that Web Settings page reachable for your onboarding call. It also holds Allowed Return URLs, which needs an entry before the authorisation will run, and the Rig team adds one with you on the call rather than you setting it up in advance.

Get the refresh token

Three things happen, in this order:

1. Someone signs in and consents. There is no portal to navigate to for this. Amazon's sign-in and consent page lives at amazon.com/ap/oa and only opens through a link built from your client ID, which the Rig team builds with you on the call. What you see is the ordinary Amazon sign-in followed by a screen asking you to grant your application access. Sign in as the account that holds the advertiser access you confirmed above. Whoever signs in here is what fixes the advertisers the token can ever read, so a personal login that happens to be nearby produces a token that works perfectly and returns nothing.
2. Amazon returns a one-time code. It comes back on the return URL and it expires within minutes, so it is not something to save or send on.
3. The code is exchanged for the refresh token. That code goes back to Amazon together with your client ID and secret, and Amazon answers with the refresh token. This is the value Rig stores, and it is long-lived.

Connect it in Rig

1. In Rig, open Connections and go to Sources & actions.
2. Search for Amazon Ads and open the card.
3. LWA client ID and client secret: from your Login with Amazon application.
4. Refresh token: the token from your onboarding call.
5. Profile IDs (optional): leave blank to sync every profile the account can see. A profile is one advertiser in one marketplace, so an account selling in five countries has at least five.
6. Region (optional): the region you noted above. Leave it blank to let Rig search all three.
7. DSP advertiser IDs (optional): only for the ADSP Reports link path.
8. Click Test, then Sync.

What Rig pulls in

Amazon Ads lands in its own amazon_ads schema:

• Profiles, one per advertiser and marketplace
• Sponsored Products structure: campaigns, ad groups and keywords
• Sponsored reporting: daily performance for Products, Brands and Display
• DSP reporting: campaign, audience, inventory, product, technology, geography, reach and brand suitability

Rows carry their profile, country and currency, because Amazon reports in each profile's native currency. US rows arrive in dollars and UK rows in pounds, so any blended total needs converting rather than summing.

How far back reporting goes

Amazon retains report data for different periods per ad product, and no tool can reach past those limits:

• Sponsored Products: about 95 days
• Sponsored Brands: about 60 days
• Sponsored Display: about 65 days

Rig syncs roughly 93 days and keeps up daily from there, so history accumulates in your warehouse well beyond what Amazon itself will hand back. That is a good reason to connect earlier rather than later: the window you miss is not recoverable.

Troubleshooting

• It authenticates but sees no advertisers: the credentials are valid and the access is not. Re-read the access section: this is the failure this connector produces most.
• A profile is missing: check the region. UK profiles live under eu, not a separate UK region, and setting the region filter too narrowly hides the rest.
• Sponsored Brands or Display reports are empty: those products are not sold in every marketplace, and an advertiser with no campaigns for a product returns nothing.
• Totals look wrong across countries: you are probably summing mixed currencies. Group by currency_code first.
• DSP data is missing entirely: either the account has no DSP access, or you need the ADSP Reports link approved by the advertiser's admin.