PA-API v5 Retired May 15, 2026: What Changed for WordPress Affiliate Sites
Quick answer: The PA-API v5 SigV4 endpoint started returning auth errors on May 15, 2026. The Creators API v3.x (OAuth 2.0 with Login with Amazon) is the surviving product data path. PaapiPlugin already supported both auth flows in the same release, so existing v2.x users were not blocked.
What you will see now if your site is broken
The retirement is not graceful. The endpoint did not redirect to a new URL. It started rejecting requests with HTTP 401 and HTTP 403 responses some time after midnight UTC on May 15. If your WordPress affiliate site stopped showing Amazon products, you are most likely seeing one of three things in your error logs or in the plugin admin.
Server: AmazonS2
x-amz-rid: ...
{ "__type": "AccessDeniedException", "message": "Unable to determine service/operation name to be authorized" }
-- or --
HTTP 404 from webservices.amazon.com/paapi5/searchitems
Front-end pages with product widgets will either render as empty containers, show a generic "no results" message, or display a stale cached snapshot until that cache expires. The first two symptoms are auth failures from the retired SigV4 endpoint. The third is what you see when an SDK still tries to hit a host or route that is no longer there.
Why this happened: Amazon's deprecation timeline just finished
Amazon announced the migration off PA-API v5 well in advance. The Creators API rolled out in 2024 with OAuth 2.0 authentication built on Login with Amazon (LwA), and the original Cognito flow used during the Creators API beta was itself retired earlier in 2026 in favor of LwA. May 15, 2026 was the published end-of-life for the SigV4 product data endpoint.
If you missed the email, you are not alone. The deprecation notices went to the contact address on the Amazon Associates account, and those addresses often point at an inbox nobody checks. The plugins that handled this quietly are the ones that already supported the new auth flow under the hood.
What to do today (pick your path)
Path A: You use PaapiPlugin
Open the plugin settings. If the "Authentication" tab shows Creators API credentials (a client_id starting with amzn1.application-oa2-client. and a client_secret), you are already on the surviving path and your site should still be returning products. If the tab still shows only Access Key / Secret Key fields from the old SigV4 flow, switch to the Creators API tab and follow the inline setup link. The v2.x release supports both auth flows side by side, so you can paste in Creators API credentials and the plugin will route new requests through Login with Amazon automatically.
Path B: You use AAWP
AAWP added Creators API v3 credentials support in v5.0.5 (February 2026). Update to the latest release (v5.0.6, April 2026), open the plugin settings, and switch the Amazon credentials section to "Creators API" mode. AAWP also operates its own optional paid API layer that lets you display products without your own product API credentials at all, which is a viable bridge if you do not yet have access to the Creators API.
Path C: You use AzonPress
AzonPress added Creators API support in v2.2.4 (March 2026). Update, then move your credentials over. AzonPress also includes a no-API mode for sites that have not been approved for product data API access yet.
Path D: You use Lasso
Lasso paid plans use a no-API Amazon image and price sync on Creator and higher tiers, so most Lasso sites were insulated from the retirement. If you are on the free tier and were syncing images with your own PA-API credentials, you will need to migrate those credentials to the Creators API or upgrade to Creator+ to use the no-API path.
Path E: You use AmaLinks Pro or EasyAzon
Both products are gone. AmaLinks Pro shut down on December 29, 2025. EasyAzon now redirects to AAWP. If your site still has either plugin installed and active, you are likely seeing the symptoms above plus stale data, since neither product is shipping fixes. The two natural migration paths are AAWP (curated product display) or PaapiPlugin (live on-site product search). Pick based on which job your site does.
Path F: You wrote your own integration
If you built a custom Amazon product data integration directly against PA-API v5, the work is bigger than swapping an endpoint URL. The Creators API uses OAuth 2.0 with Login with Amazon, the request signing scheme is different, and the scope you need to request on the token is creatorsapi::default. The error you will see if you forget the scope, or if you request a scope that your application is not approved for, is an invalid_client response from the LwA token endpoint. We have a deeper walkthrough of that error in our Creators API v3 invalid_client troubleshooting guide.
How to verify your site is still working
Once you have moved to Creators API credentials, do not trust the admin "test connection" button alone. That button validates the token exchange, not the product data path. Run through this four-step check:
- Open your live affiliate page in an incognito window. Confirm that product widgets actually render with current pricing, not a stale cached snapshot.
- Search for a product that is unlikely to be in your cache. If it returns a result, your live search path works.
- Open browser DevTools and check the Network tab for any 401, 403, or 5xx responses from your plugin's product endpoint.
- Click an affiliate link and confirm the destination URL still carries your Associate tag. The auth migration does not change tag handling, but it is the kind of thing worth verifying when you are already in there.
Tip: If you are seeing intermittent failures rather than a full outage, you are probably hitting a mix of cached and live responses. Flush your plugin cache, then re-run the four-step check.
What changed under the hood
The mechanical changes are worth understanding so you know what your plugin is doing on your behalf, even if you never touch the auth code yourself.
- Auth provider: moved from AWS SigV4 (Access Key + Secret Key + region) to Login with Amazon (OAuth 2.0 client credentials grant).
- Credentials: Access Key / Secret Key pairs are replaced by a client_id (begins with
amzn1.application-oa2-client.) and a client_secret issued through the Creators API onboarding flow. - Token scope: requests must include
scope=creatorsapi::defaultwhen fetching an access token. Wrong scope or unapproved scope returnsinvalid_client. - Endpoint host: moved from
webservices.amazon.{tld}(the PA-API v5 host) to the Creators API host on each marketplace. - Request shape: Creators API v3 uses REST-style resource paths and a bearer token in the
Authorizationheader. The old PA-API v5 SDK request bodies do not transfer one-for-one; operation names and resource lists changed. - Earlier Cognito flow: the original Creators API beta used Amazon Cognito for auth. That flow was already deprecated in favor of LwA before May 15. If you onboarded during the beta, make sure your credentials are LwA-format, not Cognito.
For a full side-by-side of the two APIs and a worked migration walkthrough, see our Creators API vs PA-API v5 guide. For the longer-form explainer on what the migration meant in the months leading up to today, see our earlier post on whether your affiliate plugin was ready.
Frequently asked questions
Will my existing plugin still work?
It depends on whether your plugin shipped Creators API v3 support before May 15. AAWP (v5.0.5+), AzonPress (v2.2.4+), and PaapiPlugin all support the Creators API auth flow. Lasso paid tiers use a no-API path and were insulated. AmaLinks Pro and EasyAzon are no longer shipping. If your plugin has not had a release in 2026, assume you will need to switch.
What error code will I see if I am still on PA-API v5?
The most common signatures are an HTTP 403 with InvalidSignature or AccessDeniedException in the response body, a 401 unauthorized, or a generic timeout from the SDK because the route is no longer responsive. Cached widgets may keep rendering until the cache expires, which is why some sites only saw the breakage hours after midnight UTC.
Do I need new credentials?
Yes. The old Access Key and Secret Key pair from PA-API v5 will not authenticate against the Creators API. You need to onboard through the Creators API portal, register an LwA application, and obtain a client_id (starts with amzn1.application-oa2-client.) and a client_secret. Your Associate tag stays the same.
How do I migrate to Creators API v3.x?
The short version: complete Creators API onboarding in the Amazon Associates portal, register a Login with Amazon application, copy the client_id and client_secret into your plugin's Creators API auth fields, request access tokens with scope=creatorsapi::default, and let the plugin route product data calls through the new endpoint. For the long version with screenshots and gotchas, read our Creators API vs PA-API v5 guide.
What if I see invalid_client errors?
An invalid_client response from the LwA token endpoint usually means one of four things: a typo in the client_id or client_secret, a mismatch between the credentials and the application's approved scopes, a request that omitted the scope=creatorsapi::default parameter, or an application that was registered as a public client instead of a confidential client. We walk through each cause in our Creators API v3 invalid_client troubleshooting guide.
Does my plugin handle the new auth automatically?
If your plugin shipped Creators API support, yes. The major active plugins all support both PA-API v5 and Creators API v3 auth flows in the same release, so pasting Creators API credentials into the auth tab is usually enough. If you keep PA-API v5 credentials, those continue to work for any non-product calls that still accept SigV4. New installs of recent releases default to the Creators API tab because that is the surviving path. See the features page for the full auth and caching detail or the pricing page for plan tiers.
Is there any data loss?
No. The retirement is an auth and endpoint change, not a data wipe. Your Associate account, your historical earnings, your cached product data, and your existing affiliate links are unaffected. The only thing that stopped working is the legacy product data endpoint. Once your plugin authenticates against the Creators API, product data resumes.
Stuck on the migration?
PaapiPlugin supports both auth flows in the same release. Install the free version, paste in your Creators API credentials, and you are back online.
