Many Amazon sellers need buyer details, such as the shipping address, in Business Central. They use these details to ship their own orders, apply the correct VAT, and send correct invoices to business buyers. Amazon protects buyer data closely and shares it only with applications that it has reviewed and approved for that purpose.
Tinx Amazon Connector maintains the connection between Business Central and Amazon. To make that connection, the connector needs Amazon API keys. You get the API keys in one of two ways:
- From the Tinx public application.
- From your private application. You register a private application in Amazon Seller Central. A private application doesn't replace Tinx Amazon Connector. It gives you your own API keys to enter in Business Central. However, unlike the public application, a private application can also request the restricted roles that you need to access buyer personal data.
In this article, you learn when to choose a private application over the Tinx public application, and how to create one in Amazon Seller Central to generate its API keys.
Choosing between a public and a private application
You need either a public or a private application to connect your Amazon Seller Central account to Business Central.
- Private application: Available only to your company and self-authorized. A private developer builds applications that integrate their own company with Amazon APIs.
- Public application: Publicly available, such as the Tinx public application, and authorized by each seller that uses it. A public developer builds applications that other companies can use.
The core difference between the two application types is access to Amazon's restricted roles. In the Tinx Connector context, only a private application can request and receive the restricted roles. Without the restricted roles, an application can't access personally identifiable information (PII), such as buyer name, shipping address, phone number, or tax identifier.
In the Tinx Connector context, a private application without the restricted roles works similarly to the public application. With either of them, you can't import PII automatically. However, you can still import PII manually. For more information, see Importing Amazon customer data to Business Central. If you don't plan to import PII automatically, Tinx recommends that you use the Tinx public application. A private application without the restricted roles can have slightly fewer capabilities than the Tinx public application.
Most companies using Tinx Amazon Connector import only orders from Amazon, not customer data. Some companies still want the shipping address included on their orders. To import the shipping address automatically, you need the restricted roles. If you need only non-PII data, such as data to maintain your stock, both application types work the same.
If you don't need the restricted roles, use the Tinx public application. You can start using it immediately, without registering as a developer or creating and authorizing your own application. For more information, see To authorize the Tinx public application in Seller Central. Alternatively, you can use a private application without restricted roles. After Amazon approves your developer profile, the API keys of a draft application are available right away.
If you need PII, register as a private developer and create a private application. For more information, see To register as a private developer. A new private application doesn't have the restricted roles. You get them only after Amazon approves your restricted roles request. After you get access to Amazon with the private application, you still need to wait for Amazon to grant the restricted roles. For more information, see Getting PII access for your private application.
If Amazon doesn't approve your restricted roles request, you can still bring PII into Business Central. Export the data from Amazon manually, and then import it into Business Central by using an upload function in Tinx Connector. For more information, see Importing Amazon customer data to Business Central.
If your Amazon selling plan is Individual, you can't register a private application to call the Selling Partner API (SP-API). You need a Professional selling account. For more information, see Selling Partner API registration overview. You must also be the Primary User of your Seller Central account to complete registration. For more information, see Self-authorization.
To register as a private developer
Follow these steps to register as a private developer.
This section summarizes Amazon's own documentation for the Tinx context. For more information, see Amazon's Register as a Private SP-API Developer.
Sign in to Seller Central.
-
Register as an Amazon Developer/Selling Partner as a private developer.
Create the account with the Private Developer account type. A private developer can create applications only for their own company. Those applications are self-authorized.
On the Seller Central main menu, select Apps and Services, and then select Develop apps.
If you don't have a developer profile, choose Proceed to Developer Profile, and then enter your company and contact information.
For the developer type, select Private.
-
Select the required access role.
Restricted roles require additional approval from Amazon and are more difficult to obtain than other roles. From the Tinx Connector perspective, the most important roles are Direct-to-Consumer Shipping (Restricted) and Tax Invoicing (Restricted). Before you select a role, make sure you understand what data each role gives you access to. Request only the roles that cover the data you want to import from Amazon. For more information, see Selling Partner API Roles.
-
Complete the Security Controls questionnaire.
-
Submit the application.
Amazon evaluates your registration application, which can take a few days. If Amazon rejects your request, you can review and resubmit the application after you make the required changes.
If Amazon contacts you for more information, respond within five days. If you don't respond in time, Amazon closes the case without granting Selling Partner API (SP-API) access. You then need to submit a new application.
Getting PII access for your private application
When you select the restricted roles, Amazon requires extra approval before your application can access PII, such as addresses, email addresses, phone numbers, and tax IDs.
This section summarizes Amazon's own documentation for the Tinx context. For more information, see Amazon's Roles in the Selling Partner API and Authorization with the Restricted Data Token.
The approval process works as follows.
- You submit the application with the Security Controls questionnaire, in which you explain how your company handles PII.
- Amazon reviews the Security Controls questionnaire manually and might follow up with more questions.
- After Amazon approves the restricted access, the OAuth flow includes an extra consent screen. This screen requests explicit permission to access PII, such as addresses, email addresses, phone numbers, and tax information.
If Amazon hasn't approved the Security Controls questionnaire, your application won't receive a Restricted Data Token (RDT), and PII fields won't be available. This happens even if the OAuth flow completes successfully.
Requesting the restricted roles can take up to two months. Even then, Amazon doesn't approve every request. Make sure your answers in the Security Controls questionnaire are accurate, thorough, and relevant. Involve a person or company experienced with Amazon Seller Central and Selling Partner API (SP-API) compliance. Tinx works with a consultancy that can help with this process. For more information, see Amazon Seller Central developer profile consulting.
To create a private application
After Amazon approves your developer profile, you can create a private application to call Selling Partner API (SP-API) endpoints.
This section summarizes Amazon's own documentation for the Tinx context. For more information, see Amazon's Register Your Application and Self-Authorization of Private Applications.
-
On the Seller Central main menu, choose Apps and Services, choose Develop apps, and then choose Add new app client.
Fill in the App name and API Type fields.
-
Select the Roles that you want your application to use. You can choose only roles that Amazon approved for your Developer Profile.
-
Choose Save and exit. Seller Central creates the application in Draft status.
You don't need to publish a private application. For more information, see Authorize private applications. The Draft status is enough to generate secrets that let you establish a connection between Business Central and Amazon. A draft application doesn't include any restricted roles until Amazon approves your request.
-
Choose Authorize, and then follow the on-screen instructions.
-
On the Manage Authorizations page, select Authorize app for the marketplaces that you want to authorize the application for.
-
After you select Authorize app, Seller Central displays the Refresh Token value. Save the refresh token to a secure location. You use this refresh token in Business Central to access Amazon data through the Selling Partner API (SP-API).
Return to the Developer Central page.
-
Select View in the LWA credentials field.
-
On the LWA credentials page, copy the Client identifier and Client secret values. Save them to a secure location.
Install Tinx Amazon Connector, and then set up the Sales Channel Card page in Business Central by using the API keys that you generated. For more information, see To install Tinx Amazon Connector and complete the initial configuration.
Related information
Connect Business Central with
Amazon
Exchanging data with Amazon
Tinx Amazon Connector
overview
Synchronize products with
Amazon
Key concepts in Tinx
Connector
Troubleshooting
checklist
Get help
from Tinx Support
Last updated on October 12, 2026