Amazon Seller Central user permissions let the account owner give employees and outside partners their own logins, each limited to the tools they need. You set them under Settings > User Permissions: staff go in Manage Employees, while agencies are authorized as Service Providers under Manage Services. Nobody should work from the owner’s login.
That last sentence is the whole point. Amazon’s Set and edit user permissions page says credentials are unique and shouldn’t be shared, and that you answer for everything the people you add do inside your account. So this feature is about control, not convenience. If you’d like an outside team to run the account with properly scoped access, our Amazon account management service sets this up during onboarding.
One requirement first. Permissions exist only on the Professional selling plan. Individual sellers can’t add anyone, so upgrading comes before inviting. My guide to setting up a Seller Central account covers that plan choice.
Three kinds of user
Amazon recognizes three roles. Most access mistakes I’d point to come from mixing them up.
The primary user registered the account. Amazon also calls this person the account administrator. They see every page the account type offers, and Amazon itself can’t grant permissions for them.
A secondary user is an employee the primary user invites. They see only what they’re given. Nothing more.
A service provider is anyone outside your business: an agency, a consultant, a freelancer, a software company. Amazon’s service provider authorization page is explicit that external parties belong here, not on the staff list.
Here’s how Amazon compares the two invited types, as of November 2026:
| Employee (secondary user) | Service provider | |
|---|---|---|
| Who | Your own staff or team members | Agencies, consultants, contractors, third-party businesses |
| How access is granted | Invited in Manage Employees; you assign roles | Authorization link or Service Provider Network; scoped to the provider’s pre-approved roles |
| How long it lasts | Until you remove it | 365 days, then it must be reauthorized |
| Where you manage it | Manage Employees | Manage Services |
I like the 365-day expiry on provider access. It forces a yearly decision about whether an outsider still belongs in your account. Staff logins get no such prompt. That’s why they need a manual audit, which I cover further down.
How to add a user to Amazon Seller Central
Adding an employee takes about two minutes:
- From the Settings drop-down, select User Permissions.
- Go to Manage Employees, then Invite Employee.
- Enter the person’s name and email, then click Send invitation.
- The invitee follows Amazon’s email to accept and create a login.
- Back on the same page, click Edit beside their name and set what they can touch. Save.
A few habits help. Use an email address that belongs to that person alone, never a shared inbox. Amazon staff on the Seller Forums suggest a fresh address for each secondary user, and it keeps two-step verification tied to one human being. When you invite someone whose Amazon sign-in uses a different email or phone, expect an extra approval step.
Set permissions straight after acceptance. New users start with very little, which is safe. The real risk comes later, when a frustrated employee asks for “everything” and gets it.
What the access levels mean
Every tool area (orders, inventory, pricing, reports and so on) has its own setting. The levels are None, View, and View and edit.
- None hides the tool.
- View lets someone read the page but change nothing.
- View and edit lets them act: edit listings, change prices, confirm shipments or issue refunds, depending on the tool.
One row deserves special care. According to Amazon, an employee becomes an administrator once they hold View and edit on the User Permissions page itself. An administrator can then manage access for other staff and for service providers. That single tick hands over the key cabinet. My rule: one trusted deputy at most, and in a small business, often nobody but the owner.
Some blogs describe a fourth “Admin” level on every tool. I couldn’t find that on Amazon’s own pages, so don’t count on it. The administrator role Amazon does document is the one created through User Permissions.
Global permissions across marketplaces
Selling in several stores? You may see a separate global screen for tools that sit above any one marketplace. An Amazon staff reply on the forums describes adding a user to the global account, then using “Manage global permissions”, with Subscribe and Save set to None, View only, or View and edit. Menu labels here have shifted over the years. Treat that as a pointer, not an exact path. The principle doesn’t change: grant the minimum.
Why sharing your primary login is a bad idea
Plenty of sellers still hand their main email and password to a VA or an agency. It feels quicker. I think it’s the wrong call, for three reasons.
First, the contract. The Business Solutions Agreement says you alone are responsible for keeping your password secure and for any action taken under it. A shared login doesn’t spread that liability. It concentrates it on you while erasing any record of who did what.
Second, two-step verification. On one shared login, every code lands on one phone. Staff end up texting the owner for codes, or somebody moves the codes to a device the owner doesn’t control. An Amazon staff reply in the forums recommends a separate login for each employee, each with its own two-step setup, and says Amazon’s terms favor separate accounts over shared credentials for accountability.
Third, exits. When a contractor leaves, removing a secondary user takes seconds. Undoing a shared password means changing it, resetting verification and checking nothing changed meanwhile, such as the deposit bank account. Honestly, I’d treat a shared primary login as an account health risk on its own, because the financial settings and identity details sit right behind it. If the worst does happen, our guide to an Amazon seller account suspended explains the first steps.
How to give an agency access to Seller Central
Agencies are external. Amazon wants them authorized as service providers, not invited as staff. The route depends on how you found them.
If you’ve already chosen the agency, they generate an authorization link in Amazon’s Solution Provider Portal and send it to you. Open it, review the roles they’re approved for, untick any you don’t want, optionally limit access by country or region, and choose Authorize Provider. Browsing the Service Provider Network instead? You can authorize a listed firm from its profile; the provider then accepts the request to switch access on.
You must be the owner or an administrator for this, and the provider must be registered in Solution Provider Portal with approved roles. That second condition is a handy filter. An agency that can’t send a link, and asks for your password instead, is telling you how it works. ZonHack is an Amazon SPN partner, and this authorization route is the one I’d insist on with any firm you hire. My checklist on how to evaluate Amazon FBA agencies before hiring lists other questions worth asking.
Least privilege: match access to the job
Least privilege means each person gets only what their task needs. For an agency, here’s where I’d start:
| Job the agency is doing | Seller Central access I’d start with | Usually not needed |
|---|---|---|
| Advertising (PPC) only | Ads access, plus View on business reports | Pricing edits, payments, user permissions |
| Listing optimization | View and edit on catalog and listings | Payments, refunds, user permissions |
| Account health and appeals | Performance pages, case log, View on orders | Payments, bank details, user permissions |
| Reporting or audit | View on reports and performance | Any edit rights |
These are my judgments, not Amazon rules. Your scope of work should drive the list. When an agency asks for something outside it, ask why before you tick the box.
Advertising access is set separately
Ads has its own permission model. Amazon Ads (its console has been called Amazon Ads Agent since September 29, 2026) uses four levels for sponsored ads accounts, per its account permissions page:
- Admin: payment settings, managing users, linking accounts, plus everything below.
- Editor: creating and editing campaigns, viewing billing history and reports.
- Viewer: viewing campaigns, billing history and reports.
- Custom: specific advertising applications only.
For seller accounts, Amazon’s add or remove users page says seller account admins invite ads users through User Permissions in Seller Central. Agencies with a manager account can also link your advertiser account to it at a chosen access level. For a PPC firm, Editor fits. I wouldn’t give Admin. It includes payment settings and the power to add yet more users.
Two related details. The Ads console has a Third Party Applications tab under Access and Settings listing every connected app and who authorized it, and each app inherits the level of whoever connected it. Then there’s your Merchant Token, found under Settings > Account Info > Business Information in Seller Central. The ads account uses it to attribute conversions, and tools often request it. It’s an identifier, not a password. Still, I’d share it only with parties you’ve authorized.
How to remove a user or an agency
Revoking should be quicker than granting. It is.
For an employee: Settings > User Permissions, find them under Manage Employees, open the drop-down beside the name and choose Remove user.
For a service provider: open Manage Services, find the firm, choose Remove (some screens say Disable Authorization) and confirm. Per Amazon’s removal page, it’s immediate, any automations the provider runs will stop, and it can’t be undone. Restoring access later needs a brand-new authorization link. Removal doesn’t end your contract outside Seller Central either, so handle that separately.
My rule of thumb: revoke on someone’s last day, not whenever you get round to it. Then change any shared secrets they knew, such as a team inbox password.
A simple audit habit
Access drifts. People change roles. Freelancers finish. Tools get connected and forgotten. A short routine keeps it tidy:
- Monthly, read through Manage Employees and Manage Services. Anyone you don’t recognize, or whose work has ended, comes out.
- Quarterly, check who holds View and edit on User Permissions and who can edit payment or bank details. Keep that list tiny.
- Before each provider’s 365-day expiry, decide deliberately whether to reauthorize. Don’t renew on autopilot.
- On the Ads side, review the Users tab and the Third Party Applications tab together.
About 10 minutes a month is cheap insurance. In my view the bigger danger isn’t a malicious insider. It’s a forgotten login, still sitting there with edit rights. If you’d rather someone else ran these checks, see my guide on how to hire an Amazon account management expert.
ZonHack’s Amazon account management service can set up and audit your users and partner access as part of running the account. Want to talk it through first? Book a free call.
FAQ
Where are user permissions in Amazon Seller Central?
Click the gear icon at the top right and pick User Permissions. Staff appear under Manage Employees, outside partners under Manage Services. The page only shows up on Professional plan accounts.
How do I add a secondary user on Amazon?
As primary user or administrator, choose Invite Employee in Manage Employees, type their email and send. Once they accept, click Edit beside the name and set each tool to None, View or View and edit.
How do I give an agency access to Seller Central?
Ask the agency for an authorization link from Solution Provider Portal, or authorize them from their SPN profile. Review the roles, drop any they don’t need, then confirm. Access runs 365 days unless you cut it sooner.
Is it against Amazon’s rules to share my Seller Central login?
Amazon’s help page says login details are unique and not to be shared, and the seller agreement holds you solely responsible for anything done with your password. Secondary users and provider authorization exist precisely so you never have to.
Can a secondary user change permissions for others?
Only after being made an administrator, which happens when they get View and edit on the User Permissions page. Without that, they can’t even open it.
Does Seller Central access include Amazon Ads access?
No, ads is a separate permission. Seller account admins invite ads users through User Permissions, and each person gets an Ads level such as Admin, Editor, Viewer or Custom.
How long does a removed agency keep access?
Zero seconds. Amazon says removal takes effect the moment you confirm, and restoring it requires a fresh authorization.
Last updated: November 10, 2026. Seller Central menu names change often; confirm on the linked Amazon help pages before acting.
