README

Click on the image to watch the video.

The Selling Partner API SDK for PHP enables you to easily connect your PHP application to Amazon's REST-based SP-API.

This SDK helps developers:

Authenticate with Amazon's Selling Partner API (SP-API)
Send and receive data using RESTful endpoints
Manage Amazon marketplace operations programmatically

Getting started

Credentials

Before you can use the SDK, you need to be registered as a Selling Partner API developer. If you haven't done that yet, please follow the instructions in the documentation. You also need to register your application to get valid credentials to call SP-API. If you haven't done that yet, please follow the instructions in the documentation. If you are already registered successfully, you can find instructions on how to view your credentials in the documentation.

Installation & Usage

Minimum Requirements

To run the SDK you need PHP 8.3 or higher.

Installation

Install the SDK via Composer:

composer require amzn-spapi/sdk

Manual Installation

By using the download files, composer dependencies are already installed. You only need to include autoload.php:

<?php
require_once('/path/to/OpenAPIClient-php/vendor/autoload.php');

Use the SDK

In order to call one of the APIs included in the Selling Partner API, you need to:

Configure credentials and marketplace ids. We provided a .env file to test the SDK in php/sdk/.env
Create an instance for a specific API (e.g. Orders API)
Call an operation

<?php
require_once(__DIR__ . '/vendor/autoload.php');

use SpApi\AuthAndAuth\LWAAuthorizationCredentials;
use SpApi\Configuration;
use SpApi\Api\orders\v0\OrdersV0Api;


// Set up LWA credentials
$lwaAuthorizationCredentials = new LWAAuthorizationCredentials([
"clientId" => "amzn1.application-**************",
"clientSecret" => "***********",
"refreshToken" => "***********",
"endpoint" => "https://api.amazon.com/auth/o2/token"
]);

//Initialize config
$config = new Configuration([], $lwaAuthorizationCredentials);

// Setting SP-API endpoint region
$config->setHost('https://sellingpartnerapi-na.amazon.com');

// Create a new HTTP client
$client = new GuzzleHttp\Client();

// Create an instance of the Orders Api
$api = new OrdersV0Api($config, $client);

try {
    // Call getOrders
    $result = $api->getOrders(
        $marketplace_ids = ['ATVPDKIKX0DER'],
        $created_after = '2025-01-01'
    );
    print_r($result);
} catch (Exception $e) {
    echo 'Exception when calling OrderApi->getOrders: ', $e->getMessage(), PHP_EOL;
}

Built-in rate limiter

The SDK comes with a built-in rate limiter. In case you hit a certain rate limit, calling an operation will throw RateLimitExceededException. Catch this exception and handle it appropriately. By default, a standard rate limit configuration is applied. You can find the current rate limit configuration for each API on a dedicated page in the documention (e.g. for Listings Items API).

It is possible to disable the built-in rate limiter by setting rateLimiterEnabled to false when instantiating a API instance:

$api = new OrdersV0Api($config, $client, false);

It is also possible to override the default rate limit configuration. This has to be done after the API instance has been created and for each operation separately:

$rateLimitConfiguration = [
    'id' => 'spApi',
    'policy' => 'token_bucket',
    'limit' => 5, // capacity of bucket
    'rate' => [ // refill rate
        'interval' => '1 second',
        'amount' => 50
    ],
];

$factory = new RateLimiterFactory($rateLimitConfiguration, new InMemoryStorage());
$api->getOrderRateLimiter = $factory->create("<insert-unique-id>"); // Use unique id in create-method

Skipping model validation

Model classes contain additional validations in their setters (allowable enum values, string length, numeric range, regular expression pattern, and item counts) that are derived from the OpenAPI model definitions. Backend responses are not always consistent with those constraints, so deserializing a response can throw an \InvalidArgumentException even though the response itself is valid.

To handle these cases, you can disable the additional model validations at the configuration level. When enabled, model setters still store the returned values but no longer throw for values that violate the declared constraints. This applies to every response (including error responses) deserialized by an API instance that uses the configuration:

// Initialize config
$config = new Configuration([], $lwaAuthorizationCredentials);

// Skip the additional model validations during deserialization
$config->setSkipModelValidation(true);

// APIs created with this config will no longer throw InvalidArgumentException
// for backend responses that violate the OpenAPI model constraints
$api = new OrdersV0Api($config, $client);

The flag defaults to false, so validation is applied unless you explicitly opt out.

⚠️ Use with caution. Skipping model validation disables the safeguards that normally reject malformed values. It is intended as a workaround for responses that are known to be valid but do not match the OpenAPI constraints. When the flag is enabled, unverified values pass through unchecked, which can lead to downstream errors (for example, invalid enum or out-of-range values propagating into your application logic or into subsequent API requests). Only enable it when you understand the responses you are processing, and validate the data yourself before relying on it.

Restricted Data Token (RDT) Support

The SDK provides built-in support for working with Restricted Data Tokens (RDTs), which are required to access personally identifiable information (PII) in certain API operations.

To use Restricted Data Token with the SDK:

Request an RDT token using the Tokens API.

// Create a restricted resource
$resource = new RestrictedResource();
$resource->setMethod('GET');
$resource->setPath('/orders/v0/orders');
$resource->setDataElements([
    'buyerInfo',
    'shippingAddress'
]);

// Get a Restricted Data Token
$tokensApi = new TokensApi($config);
$request = new CreateRestrictedDataTokenRequest();
$request->setRestrictedResources([$resource]);
$response = $tokensApi->createRestrictedDataToken($request);
$rdtToken = $response->getRestrictedDataToken();

Use the token when calling restricted operations:

// Pass the RDT token to the API call
$response = $ordersApi->getOrders(
    ['ATVPDKIKX0DER'],  // marketplace_ids
    '2023-01-01T00:00:00Z',  // createdAfter
    null,  // createdBefore
    null,  // lastUpdatedAfter
    null,  // lastUpdatedBefore
    ['Shipped'],  // orderStatuses
    restrictedDataToken: $rdtToken  // Pass RDT token
);

Check the full implementation example. If you pass the Restricted Data Token to operations which does not require it, the SDK will return an exception error. Operation does not require a Restricted Data Token (RDT). Remove the RDT parameter for non-restricted operations.

Giving Feedback

Feedback and Contributions

Your feedback is invaluable in improving this SDK! You can contribute by:

Reporting issues: Submit an issue

Disclaimer

FBA Inbound V0 API is named as FBAInboundApi.php
FBA Inbound v2024-03-20 API is named as FulfillmentInboundApi.php
FBA Eligibility API and PricingV0 API operations are still not supported.
Finances API is named as DefaultApi.php.

amzn-spapi / sdk

Maintainers

Package info

Statistics

Security