Securing Your Seller Central Account: Access, Sign-In and Recovery

A Seller Central account holds your listings, your payouts, your customer data, your advertising and your reputation. It also tends to be used by more people than anyone planned: a co-founder, a virtual assistant, an agency, a software tool. Most security failures are not clever attacks. They are a shared password, a verification code that goes to a former employee's phone, or an agency login that nobody removed. This guide covers how to control who has access, how to sign in more safely, how to offboard people cleanly, and how to plan recovery before you need it.

Give each person a named login with only the access they need

Seller Central lets the account owner invite people as users and choose what each one can see or change. Use that feature for everyone, including yourself if you are not the owner. A shared login is convenient on day one and costly later. You cannot remove one person without changing the password for all. The verification code goes to one device. And you cannot easily tell who did what. If you can, keep the owner login for the few owner-only tasks and run daily work from a separate named user, so the most powerful login appears on fewer devices.

Then apply the principle of least privilege: give each person the narrowest access that lets them do the job. Sort access by two questions. How much damage could it do in the wrong hands? How often does the person need it?

Review the user list every quarter. Access tends to accumulate: a person takes on a task, finishes it and keeps the permission. Remove anyone who no longer uses the account, and lower the access of anyone whose role has narrowed.

Sign-in: second factors, passkeys and where the code goes

Two-step verification asks for a second proof in addition to the password, such as a code from an authenticator app or a text message. Seller Central uses it, and Amazon has made it a requirement for sellers. The setting is not the weak point. The usual weak point is where the proof is sent.

If every code goes to one person's personal phone, you have one point of failure. A lost or replaced phone locks everyone out, and an employee who leaves takes the second factor with them. Make sure the verification methods on the account belong to people and devices the company controls, add a backup method on a different device, and keep contact details current. Use an email address that the company owns and that survives staff changes, not one person's private inbox.

Passkeys are the newer option. A passkey replaces the typed password with a check on your own device, such as a fingerprint, face scan or device PIN, and it works only on the genuine site. That makes phishing much harder, because there is no password to type into a fake page. Amazon offers passkeys for shoppers' sign-in. Check whether and how your seller login supports them, and use the strongest method on offer.

Pair this with a password manager. Each person should have a long, unique password stored in the manager, never in a spreadsheet or a chat. Nobody from Amazon needs your verification code, so never read one out to a caller or type one into a page you reached from a message.

Agencies, freelancers and software tools

Outside help is where access most often spreads without anyone noticing. Treat every outside person the way you treat staff. Invite each one with their own company email address and a defined scope, and never hand over the owner login or the device that receives your codes. A task such as running ads or editing listings rarely needs payments or account information, so leave those out.

Keep an access register: the person, their company, the areas granted, the date added, who approved it, and a review date. Amazon Ads, Brand Registry and the area for authorized third-party apps manage access separately from Seller Central, so list each of them. Software tools connect through authorizations, so read what data a tool can reach before you approve one, and review the list of connected apps on a schedule.

Offboarding people and agencies

Offboarding is where a good access register pays off, because you know what to remove. Do it the day the person leaves or the contract ends, not at the next quarterly review. Start with the obvious step, removing the user, then work through the places where access hides.

Build the checklist into your process before it is needed. When you onboard someone, note which methods and tools they will touch, so you know what to remove later. For an agency, write the removal of access into the end-of-contract steps, and ask them to confirm in writing which of their staff held access and that it has been closed.

The last review step matters most when someone leaves on bad terms. Compare the account's contact details, deposit settings and user list with your records, and check recent notification emails for changes you did not authorize.

Plan recovery before you need it

If access is lost or the account is compromised, speed depends on what you prepared. Amazon may ask you to verify your identity or your business, and expired or mismatched documents cause delays. Keep a secure recovery folder with the business registration, the owner's identity document, a recent bank statement and the tax information, and make sure the details match what is on the account. Record who is authorized to contact Seller Support and how, and who holds each verification method.

Learn the signs of a problem. Unexpected sign-in or verification prompts, emails about changes you did not make, a new user, altered deposit details or edited listings all deserve an immediate response. Change the password, review the user list and contact Seller Support through Seller Central, never through a link in a message. Phishing often arrives as a warning about a suspension, so reach your account by typing the address or using a bookmark.

The short version

• Replace every shared login with named users, each with the narrowest access that works.
• Keep payments, identity details and user management with the owner.
• Send verification codes to devices and addresses the company controls, with a backup method.
• Use a password manager, and use passkeys where your login supports them.
• Keep an access register for staff, agencies and apps, and review it on a schedule.
• Offboard on the day, using a checklist, and keep a current recovery folder.