Amazon DSP Access and Permissions

This document explains how account type and user permissions determine which Amazon Advertising profiles — including Amazon DSP profiles — become visible after a client completes an authorization.

It addresses the most common reported symptom: the client successfully authorizes via the external link, but no Amazon DSP profiles are presented for selection.

Amazon owns the account model, the permission model, and the authorization workflow, and refines all three on an ongoing basis. We deliberately do not maintain a parallel set of instructions that would drift out of date and give clients conflicting guidance.

Amazon documents these concepts and mechanics well. This document therefore establishes the diagnostic sequence and points to Amazon's authoritative documentation at each step rather than restating it.

Our authorization does not select accounts on the client's behalf. We display exactly the set of accounts the authorizing user has been granted access to at the moment of authorization — both self-service and managed accounts.

Two consequences follow directly from this:

Establish whether the client is authorizing from a standard Amazon Ads advertiser account or from a Manager Account (MA).

Amazon describes a Manager Account as a way to manage multiple advertiser accounts under a single sign-in, with centralized user management, billing, and cross-account reporting.

This distinction matters because access granted at the Manager Account level extends to that account's child accounts. Individual child accounts may be active, placeholders, or archived, which affects what is presented and what is usable.

Permissions are defined by, and vary with, the class of account being accessed. The client should confirm that the authorizing user holds a role on that account class which includes DSP visibility.

If DSP is absent from the account entirely — for example, where the client's DSP activity is run as an Amazon managed service rather than self-service — no permission change will surface a DSP profile. In that scenario the client should contact their Amazon DSP account representative to establish console access.

Amazon defines the specific procedure for granting a user access to each account type. The client should follow that procedure for the account that holds the DSP entity, not only for the account holding Sponsored Ads.

Once permissions are corrected, the client should:

This step is not optional. Amazon and the browser will apply whichever session is already in scope, which is the most frequent cause of an authorization completing successfully against the wrong account.

If the sequence above is completed and DSP profiles are still not returned, the outstanding question is one of Amazon-side entitlement or account configuration. The client should raise it with Amazon Ads support or their Amazon account representative, referencing the specific advertiser or Manager Account identifier and the user in question.

We will always display to you the authorization returned by the Amazon Ads API for a given attempt, which is useful evidence for that conversation.