Skip to main content
AmzDownloader uses the same account API key for REST and MCP. Create or select a key in your API keys page, then send it in the Authorization header.

​
Keep credentials private

Store keys in environment variables or your client’s secret store. Do not put keys in source control, URL parameters, browser applications, analytics, or screenshots. Send your key only to https://amzdownloader.com. Media download URLs do not need your AmzDownloader key. Jobs belong to your account. A valid replacement key for the same account can poll and retrieve jobs created before rotation. Another customer’s key cannot access your jobs even if that customer knows the job ID.

​
Rename, rotate or revoke a key

Use the row menu on the API keys page to rename, rotate or revoke a key. Renaming changes its label. Rotation creates a replacement whose secret is shown once; store it in your secret manager and update your integrations. The previous key remains valid for 24 hours after rotation unless you revoke it sooner. Revocation stops that key immediately. You can use the replacement to finish existing jobs because their ownership stays with your account. Accounts can have ten still-valid keys, including keys within their rotation overlap. If you reach the limit, revoke an unused key before creating or rotating another.

​
Handle rejected keys

A missing, invalid or revoked key returns HTTP 401. Check that the environment variable is present and that you sent one supported credential header. HTTP 403 means the request is authenticated but access is denied. Read errors and retries before retrying a failed request. MCP connection instructions are in the agent guide.