Amazon Makes Passkeys Required on September 29. Your Shared Seller Central Login Dies With It.

Do two things this week. Enroll a passkey for your primary Seller Central account on two devices that do not depend on the same cloud account, and convert every person still using a shared login into a named secondary user. Finish both before September 29 and before your Q4 inbound cutoffs, not after.

That is the whole recommendation. Here is what changed and why the second item is the expensive one.

What Amazon actually said

Amazon emailed sellers on September 15, 2026. The text is direct: “Starting in two weeks, passkeys will start to be required on a rolling basis for Amazon accounts. This will be required for all of your accounts, including Seller Central and Amazon.com.”

Two weeks from September 15 is September 29. The email does not publish a universal cutover date per account or region, so treat September 29 as the start of enforcement rather than a single deadline. If you did not get the email, that does not mean you are exempt. It means your account has not been scheduled yet.

The specifics Amazon states:

• Your password stays on file as a backup recovery option but will not be available for logging in.
• Setup runs through Seller Central under Login and Security, then Passkeys, then Set up.
• Amazon recommends passkeys on at least two devices, and notes they sync automatically across devices signed into the same Apple ID, Google account, or Microsoft account.
• Seller Support will respond to passkey setup issues in under 24 hours, and can restore access after identity verification if you lose your passkey.

None of that is hard. It takes a few minutes per person. The trap is somewhere else.

The shared login is the real project

Amazon’s instruction for shared accounts is unambiguous: anyone else accessing the account must be registered as a secondary user and create their own passkey. Amazon’s own forum announcement on passkeys for secondary users says it plainly: “For security purposes, we don’t support sharing a single sign-in across multiple users.”

Now the operational landmine. Per Amazon’s setup steps, a new secondary user needs a brand-new email address that has not been used on any Amazon account before.

Read that again with your actual team in mind. Your VA in Manila has a personal Amazon buying account on her Gmail. Your warehouse lead ordered something from Amazon last month on his work email. Your agency account manager has an Amazon Prime account. Every one of those addresses is burned for this purpose. You are not sending five invitations on Friday afternoon. You are provisioning five new mailboxes on your own domain, sending five invitations, waiting on five people in three time zones to accept and enroll a passkey on a supported device, and then confirming each of them can still do their job.

For a brand running one marketplace with three people touching the account, that is an afternoon. For a brand running Amazon US, CA, UK, and DE with a 3PL, a PPC agency, a catalog contractor, and two internal operators, that is a week of calendar time and it is competing with Q4 inbound.

The device and recovery math nobody runs

Amazon says put passkeys on two devices. Good advice, and most sellers will implement it wrong.

Passkeys sync across devices signed into the same Apple ID, Google account, or Microsoft account. So the founder who enrolls a passkey on her iPhone and her MacBook, both signed into the same Apple ID, has one credential on two screens. That is not redundancy. If the Apple ID is locked, the recovery email is unreachable, or the person holding it is unavailable, the business has zero working routes into Seller Central.

Real redundancy means two independent paths. Owner’s device on one cloud identity, a second administrator on a different one, and both tested in a live sign-in before you need them.

The cost of getting this wrong is not abstract, and you can price it in about a minute:

Daily Amazon revenue x days of lockout = direct loss. A brand doing $3M a year on Amazon averages about $8,200 a day across the year. December days run well above that average, so a Q4 lockout costs more than the arithmetic suggests.

Plus the recovery tail. A seller-fulfilled business that cannot confirm shipments loses late shipment rate and on-time delivery rate, which do not reset when access comes back. A suppressed ASIN you cannot fix is dead inventory for the duration. A budget you cannot adjust during a Black Friday CPC spike overspends without you.

Amazon’s stated support response is under 24 hours. That is a service expectation, not a guarantee for your specific case, and it is measured from when you open the case, not from when you notice the problem at 9pm on a Saturday.

Weigh that against the cost of the fix, which is one person spending a few hours this week. The decision is not close.

Reported friction, not yet confirmed

Sellers in public forums reported problems during the week of September 15: a device-support error reading “This device doesn’t support passkeys” on a phone the seller believed was supported, and repeated QR code loops during enrollment. These are seller reports, not a documented Amazon outage, and Amazon has not acknowledged a widespread issue.

Treat them as a reason to test early rather than as an established fact. The operator takeaway is the same either way. Do your first passkey enrollment on a normal Tuesday, not the morning a shipment window closes.

This is the second access reset in two months

If this feels familiar, it should. Amazon retired the legacy Seller Central invite process on August 10 and is forcing sellers to reauthorize every agency and tool with account access. That project governs which providers can reach your account. This one governs how humans sign in.

They are different systems and they do not cover for each other. Reauthorizing your agency through the Solution Provider flow does not give a named human on that team a passkey. Giving your contractor a secondary user account does not restore an agency authorization that expired. If you are only doing one of the two, you have half a plan.

API integrations are a separate matter again. Authorized applications authenticate through their own tokens, so a passkey requirement should not break a connected tool. Should not is not the same as will not. Confirm it with each provider in writing rather than finding out during peak.

The checklist

Enroll the owner account first, on two independent devices. Different cloud identities. Test both in a private browser session before you rely on either.

Pull your user list. Settings, then User Permissions. Write down every human who signs in, what they do, which marketplaces they touch, and the minimum permission set they need. Delete dormant users now. This is a free security cleanup and you will not get a better prompt to do it.

Provision fresh email addresses on your own domain. One per secondary user, never previously used on any Amazon account. Company-controlled addresses mean offboarding a contractor is a mailbox change, not a hostage negotiation.

Send invitations and confirm enrollment individually. Do not assume. Have each person sign in and complete a real task after enrolling.

Write a one-page recovery runbook and store it outside Seller Central. Primary owner, secondary administrators, recovery email and phone, the business documents used for identity verification, and who is authorized to open the support case. If the runbook only exists inside the account you cannot reach, it does not exist.

Do not accept passkey help from anyone who contacts you. Start from Seller Central’s Login and Security page. Never share a QR code or screen access with someone claiming to be Amazon support.

The takeaway

Amazon is not asking whether your access hygiene is ready. It is converting your account on a schedule you do not control, roughly nine weeks before the highest-revenue days of your year. The brands that handle this in an afternoon are the ones where every operator already has a named login. The brands that lose a day of Seller Central in December are the ones still passing one password around a WhatsApp group.

If you want a second set of eyes on who can reach your Seller Central account, how they sign in, and what happens the day the person holding the credentials is unreachable, book a strategy assessment and we will map it before September 29.