Amazon Seller Central Passkeys: Setup, Team Access and Recovery Planning

First, narrow the headline correctly. Amazon’s Seller Central announcement says passkeys are being extended to Seller Central accounts from July 2026. It also says that passkeys are available to sellers and that some accounts may be required to use them later in 2026. That does not establish one universal cutover date or identical enforcement flow for every account. The current prompt shown inside the specific Seller Central account remains the controlling reference.

1. What passkeys are and what is changing in Seller Central

A passkey is a passwordless FIDO2/WebAuthn credential. The user normally approves a sign-in with the device’s unlock method—such as a fingerprint, face scan, device PIN, or security key. Biometric processing remains local to the device; the service receives the authentication result it needs rather than the user’s raw biometric data.

Amazon’s Seller Central notice says the passkey rollout starts in July 2026 and points sellers to the login-settings area for setup. The same notice distinguishes current availability from the possibility that some accounts will be required to use passkeys later. Record the message, account role, and date seen by the team. Do not turn a rollout notice into a single deadline for every store.

• A passkey is a sign-in credential, not a certificate and not proof that a store or product meets a market-access requirement.
• Use depends on the device, browser, password manager, and account configuration. Device loss, syncing, and recovery need separate planning.
• “Phishing-resistant” describes a property of FIDO authentication; it does not remove the need for least-privilege access, device control, or unusual-login review.

2. Four checks before creating a passkey

1) Identify the primary account owner

Separate the primary owner, backup owner, and day-to-day operators in the internal record. The primary owner should be able to access the information needed for account recovery. Do not share one email, password, device unlock method, or passkey among several people.

2) Inventory devices and password managers

Record the phone, computer, or hardware security key that will be registered, together with its operating system, browser, and password manager. Confirm that the device can be unlocked normally and that ownership is clear. The inventory should identify which credential needs review when a person or device changes; it should never contain the passkey secret or a device PIN.

3) Keep an account-recovery path

Before adding a passkey, confirm that the account can still use the recovery and verification methods currently offered by Amazon. Do not register a passkey on the only controlled device and immediately remove every other verification path. If the account displays an additional verification requirement, follow that account-specific prompt.

4) Leave an auditable change record

At minimum, record the account, user role, device or password manager, creation or removal time, operator, and test result. Do not put passkey private material, device PINs, or biometric information in a shared document.

3. Create and test the passkey inside Seller Central

1. Have the primary owner or an authorized user sign in to Seller Central and open the account’s login-settings area.
2. Locate the passkey setup entry. Amazon’s announcement calls the control Create Passkey, but labels can vary by account, language, and device.
3. Follow the on-screen instructions to register the current device or a supported password manager, then approve with the device unlock method.
4. Sign out and sign in again to test the new passkey. Confirm that the recovery path still works before closing the change.
5. Record the result. If the control is not visible, save the account message instead of inferring eligibility or changing unrelated security settings; use the current Seller Central help or account notice for the next step.

A successful registration proves that one device completed one registration flow. It does not give every team member access or prove that the account has satisfied a later requirement. Review high-risk permissions—payments, orders, advertising, listings, and user administration—against the team’s authorization record.

4. Team access: use secondary users instead of shared sign-in

Amazon’s secondary-user notice says that one shared sign-in should not be shared across multiple people. Each person who needs access should have an individual secondary user and register their own passkey. In Seller Central, use Settings → User Permissions to create or select the user and send the invitation through the current interface. Amazon’s notice also says that a new secondary user needs a new email address that has not previously been used on an Amazon account.

Stage	Evidence to retain	Boundary
Invite	User email, role, invitation time, and operator	Grant only the permissions needed for the job
Register	User completion, device ownership, and test result	Each user has an individual passkey; never share unlock information
Review	Review date, exceptions, and change record	Use the account’s current interface and requirements

5. Offboarding, device changes, and lost devices

When a person leaves or changes roles, first review and remove the no-longer-needed secondary-user permission in User Permissions. Then check whether that person’s device, browser, or password manager still stores a passkey for the account. If a device is lost, transferred, or no longer under confirmed control, use Seller Central’s current security and recovery flow and retain the relevant case, prompt, or action record.

For a planned device change, do not delete the old device before testing the replacement. A safer sequence is: register the replacement under controlled ownership → test sign-in and critical permissions → confirm recovery → handle the old credential. Recovery actions may trigger additional verification, so no fixed handling time or outcome should be promised.

6. Common claims that should not become internal rules

• “Every account must switch on one day in July 2026.” The official notice supports a July rollout and possible later requirements for some accounts, not one universal cutover date.
• “One passkey lets every employee sign in.” Team access should use secondary users, with one user and one credential per person.
• “A passkey replaces two-step verification and recovery information.” Passkeys, recovery, backup verification, and permission management are separate layers; follow the account’s current controls and the organization’s security policy.
• “A passkey proves store or product compliance.” It authenticates a user; it does not replace regulatory, testing, labeling, representative, or platform documentation.
• “Every device will sync in the same way.” Syncing depends on the operating system, browser, password manager, and account settings, so test the actual devices.

7. One-page preflight checklist and sources

• The primary owner, backup owner, and each secondary user have documented responsibilities.
• Each user has an individual email, permission set, and passkey; no shared sign-in is used.
• At least two recovery paths have been tested by the responsible owner, without storing PINs or private material in a shared file.
• The device/password-manager inventory, registration time, removal time, and offboarding records are reviewable.
• The account’s actual prompts, help content, and test result are saved; if they differ from this guide, follow the current Seller Central requirement.

Official sources: Amazon Seller Central: Passkeys coming to Seller Central in July; Amazon Seller Central: Give your team secure, easy access with passkeys for secondary users; Amazon: passwordless sign-in with passkeys; FIDO Alliance: Passkeys.

These sources describe feature and deployment boundaries. They do not promise account availability, a mandatory date, recovery results, or a security outcome. Confirm the latest information displayed in the specific Seller Central account.