Our Amazon Vendor Central Direct Fulfillment automation signs in to the brand's own account three times a day. When Amazon asked for a one-time password, the job read it from a dedicated mailbox. Then, overnight, the account switched to authenticator-app 2-step verification. The next scheduled run stopped at the sign-in page, waiting for a code that would never arrive by email.
What an authenticator app actually does
Google Authenticator, Microsoft Authenticator and similar apps use a standard called TOTP (time-based one-time password, RFC 6238). When you add the app, Amazon shows a QR code and, under 'can't scan?', a text key. The app combines that key with the current time and produces a six-digit code every 30 seconds. Nothing is sent to the phone — any device holding the same key and the right time produces the same code.
How we handled it
The account owner added the authenticator themselves and gave us the key through a private channel, and the same key was also added to their phone so the team can still sign in by hand. On the server the key lives in one file readable only by the service account. It is never written to logs, sheets, emails or the code repository. The sign-in step now checks which screen Amazon is showing — an authenticator prompt or an email-code prompt — and answers accordingly instead of assuming. The same login and key also open Seller Central for the brand's other Amazon account.
Three rules worth copying
First, keep the server clock synced (NTP); a clock a minute off produces codes Amazon rejects. Second, if the key is ever exposed — pasted in a chat, attached to a ticket — remove the authenticator in Amazon and add it again, which creates a new key. Third, this is only for automating your own account with the owner's agreement. 2-step verification exists to keep other people out, and nothing here weakens that.
The second surprise: an account-wide label throttle
The same week, Amazon started refusing shipping labels with a throttling error. Our job treated each refusal as a problem with that one order and moved on to try the next, which meant asking Amazon again and again. The throttle was on the whole account, not the order — even brand-new orders were refused. The job now stops early: one refusal skips that order, two in a row ends the run and sends an alert, and the team raises it with Amazon support. Hammering a throttled endpoint only keeps it throttled longer.
The longer-term route
Panel automation is a bridge. Amazon's Selling Partner API uses its own application credentials and doesn't depend on a sign-in page, so screen changes like this one stop mattering. We're moving parts of this brand's Amazon work onto it as access is approved. Until then, the lesson is simple: build sign-in steps that recognise what they're looking at, keep secrets in one locked-down place, and back off the moment a marketplace says slow down.
Read how the full routine works in Automating Amazon Vendor Central Direct Fulfillment, or talk to us about your own Amazon operations.
Frequently asked questions
How does an authenticator app generate codes?
It uses TOTP (RFC 6238): a secret key shared when you set it up, combined with the current time, produces a new six-digit code every 30 seconds. Any device with the same key and correct time produces the same code.
Can a scheduled job sign in to my own Amazon account with 2-step verification on?
Yes, with the account owner's agreement: the owner adds the authenticator and shares the key privately; the server stores it in one locked-down file and generates the code at sign-in. The owner's phone can hold the same key.
What should I do if my authenticator key is exposed?
Remove the authenticator in your Amazon account settings and add it again. That creates a new key and makes the old one useless.
What does Amazon's label throttling error mean?
Amazon is limiting label requests, often for the whole account rather than one order. Stop retrying, let the team know, and raise it with Amazon support if it persists.
Amit has 6+ years of experience building data pipelines, AI agents, and automation systems for businesses across India and globally. He founded HowAutomate to make enterprise-grade automation accessible to growing businesses.