Amazon SP-API Integration & Technical FAQ

SunCroix strictly utilizes the official Amazon Login with Amazon (LWA) OAuth 2.0 protocol. The authorization workflow follows three simple steps:

1. Initiation: The seller clicks "Authorize Now" on the Amazon Selling Partner Appstore or inside the SunCroix console.
2. Consent Screen: The seller is redirected to the official Amazon Seller Central consent page (hosted entirely on Amazon.com), which explicitly lists the requested roles (Finance and Accounting, Inventory and Order Tracking, Pricing).
3. Token Handshake: Upon seller consent, Amazon redirects back to SunCroix’s secure callback endpoint with a temporary spapi_oauth_code. Our backend securely exchanges this code over TLS 1.3 for an encrypted LWA refresh token stored in HashiCorp Vault.

Never. SunCroix strictly adheres to Amazon's Acceptable Use Policy (AUP). We never ask for, inspect, or store your Amazon Seller Central credentials. All communication is authenticated using temporary cryptographic access tokens derived from your official OAuth grant.

Merchants retain 100% control at all times. You can revoke access instantly at any time directly through Amazon Seller Central: Navigate to Partner Network > Manage Your Apps, locate SunCroix Operations & Financial Console, and click Revoke. When access is revoked, Amazon notifies our webhook and our system immediately ceases all data retrieval.

SunCroix is engineered on a strict Non-PII (Personally Identifiable Information) architectural standard. We do not request, ingest, process, or persist any Amazon buyer personal data (no customer names, phone numbers, or delivery addresses).

We only ingest operational and business data: aggregated order totals, SKU numbers, currency fee lines, settlement flat files, and warehouse inventory movement logs. This eliminates data privacy risks for buyers while delivering complete accounting transparency for operators.

In strict compliance with Amazon Data Protection Policy (DPP) Section 3.2, SunCroix does not retain Amazon information longer than necessary to provide contracted services. When a seller disconnects their account or revokes OAuth authorization, our automated data lifecycle scheduler permanently deletes all cached historical records, tokens, and database rows within 30 calendar days.

Each independent merchant or brand operates within an isolated tenant environment. We enforce PostgreSQL Row-Level Security (RLS) where every database row is partitioned by an immutable, cryptographically generated tenant_id. Cross-tenant querying is blocked at the database engine level, mathematically preventing data leakage between independent brands.

SunCroix uses the official Amazon FBA Inventory API and historical movement ledger reports (GET_LEDGER_DETAIL_VIEW_DATA, GET_FBA_FULFILLMENT_CUSTOMER_RETURNS_DATA). Our algorithms trace inventory across up to 18 months of warehouse receipts, comparing inbound deliveries, customer returns, and disposal records to detect discrepancies that Amazon has not yet automatically reimbursed.

No. SunCroix strictly adheres to Amazon Customer Service and AUP policies. We do not engage in automated bot claim submissions. Instead, SunCroix compiles verified, policy-compliant claim packages with all requisite shipment IDs, transaction logs, and ASIN documentation. Sellers or account managers review and submit cases manually or via authorized review workflows.