Rotating Amazon LWA Credentials.

Amazon requires us to rotate the Login with Amazon (LWA) client secret for our Amazon Business integration every 180 days. Miss it and our Amazon product search and ordering calls stop working. This is the end-to-end runbook: where to rotate, what to update, and the grace window that means it is never a true fire drill.

Why this happens

Since February 2023 Amazon has required app developers to rotate LWA credentials every 180 days. You will get an email from Amazon with a hard rotation deadline. The application that needs rotating is amzn1.sp.solution.a876c1d1-6b57-49fe-9e5b-ec0d913c0f9c (the PerkUp Amazon Business app).

It is not a same-minute emergency. Your old credentials keep working for seven days after you generate the new ones. The deadline in Amazon's email is when you must have rotated by — once you do, you have a week to update and deploy before the old secret dies.

The rotation, step by step

#	Where	What to do
1	Amazon Developer Central	Sign in at developercentral.amazon.com with thomas@perkupapp.com (the Amazon Business account). Developer Central lists all our apps.
2	Amazon Developer Central	Open the app's LWA credentials, click the expiration alert, then Rotate Secrets. Read the warning, confirm, and copy the new client secret. (Optional: store the old one encrypted as a fallback.)
3	GCP Secret Manager	Add the new secret as a new version of `amazon-business-client-secret` in project `perkup-app`: `gcloud secrets versions add amazon-business-client-secret --project=perkup-app --data-file=-` then paste the secret and press Ctrl-D.
4	Cloud Run	Deploy a new version of the `amazon-punchout` Cloud Run service so it picks up the new secret. The Go backend reads `amazon-business-client-secret/versions/latest`, but config loads at service init — a fresh deploy is what makes it take effect.
5	Verify	Run an Amazon gift search / order in the platform, and check `amazon-punchout` + `v2services` logs for Amazon auth errors. Confirm it works before moving on.
6	Cleanup	The old secret auto-expires seven days after rotation. Once step 5 passes you can disable the old GCP secret version — but never before verifying, so you keep the rollback.

Where the secret lives

GCP secret: amazon-business-client-secret (project perkup-app, project number 295940089036). The matching client ID is amazon-business-client-id.
Code: read in backend/app/amazon/productsearch/search.go via NewAmazonConfigFromSecretManager, which pulls amazon-business-client-secret/versions/latest.
Service to redeploy: the amazon-punchout Cloud Run service.
Amazon resource: How to rotate your app's LWA client secret.

Migrated from the legacy Outline doc "Rotating Amazon LWA Credentials" (last updated 2025-01-03), with the GCP secret name, Cloud Run target, and code path verified against perkup-app on 2026-06-13. Outline is being sunset; this wiki is the source of truth.