---
title: "Return a short-lived Amazon Ads access token"
method: GET
path: "/auth/amazon-ads/token"
tags: ["auth"]
---

# Return a short-lived Amazon Ads access token

`GET /auth/amazon-ads/token`

## Request

- Base URL: `https://api.autron.ai`
- URL: `https://api.autron.ai/auth/amazon-ads/token`
- Auth: API key in header `Authorization`

Three callers, two auth paths (autron-agent#441, #626):

- `seller_public_id` + a `ppc_audit_service`-scoped JWT (agent
  server-minted, never carried by a user session): restricted to
  PPC-audit sellers — the lead-audit pipeline, where no user exists.
- `seller_public_id` + a user bearer: that seller, authorised by
  `user_may_manage_seller`. The agent's CLAIMED audits use this — a
  report knows its seller, and inferring one from the user instead
  gave nothing at all for an invited teammate (who never has a
  primary) or the wrong Amazon account for anyone whose primary is a
  different seller in the same company.
- User bearer alone: the user's primary seller, exactly as before.

Scope is decided first, so a service token keeps the lead-audit path
and its `event == "PPC Audit"` restriction — the user path is not a
way around it.

## Response `200`

Success

---

[API](https://skmtc.dev/autron/apis/autron-api.md) · [All operations](https://skmtc.dev/autron/apis/autron-api/llms.txt) · [OpenAPI document](https://skmtc.dev/autron/apis/autron-api/revisions/f696bfa7295f?raw)