Amazon Developer

Console

as

Settings
Sign out
Notifications
Alexa
Amazon Appstore
Ring
AWS
Documentation
Support
Contact Us
My Cases

Console

as

Get started
Connect with Matter
Alexa Connect Kit
Add-ons
Certify
Resources
Skip to main content
The following frequently asked questions (FAQ) answer common questions about account linking.

​
General account linking

Your authorization server must use HTTPS with a certificate from an Amazon-approved certificate authority. For the authorization code grant, your server must return the access token and refresh token in a JSON response, and must respond within 4.5 seconds. Access tokens must have a lifetime of at least six minutes (360 seconds). For details, see Requirements for Account Linking for Alexa Skills.
Yes. You can configure account linking as optional in custom skills so that users can enable your skill and use features that don’t require authentication. When the user invokes a feature that requires account linking, your skill can send an account linking card to prompt the user to link their account. To learn which skill types require account linking, see When to use account linking.
When a user disables your skill, the account is unlinked. Alexa deletes the access token that your service provided and revokes the Amazon access token. You should also revoke your access token and delete any stored Amazon access tokens for the user. To get notified, subscribe to skill disabled events.

​
Standard account linking

The following are frequently asked questions about the standard account linking flow from the Alexa app to your website.
Standard account linking supports both the authorization code grant and the implicit grant. Amazon recommends the authorization code grant because it provides a refresh token, which allows Alexa to obtain new access tokens without requiring the user to re-authenticate. Only custom skills can use the implicit grant type. For details, see Grant types.
Because the Alexa app opens your login page in an in-app browser, your page must be mobile-friendly. Your login page must not open pop-up windows or launch JavaScript alerts or message boxes. If the user encounters an error, such as entering the wrong password, the login page should display the error inline. For details, see Design the log-in page.

​
App-to-app account linking starting from your app

The following are frequently asked questions about the app-to-app account linking flow that starts from your app.
For an example of how to determine this in iOS, see Example: Open the URLs in Step 4: Make an Authorization Request from Your App.
You make a Get account linking and skill status request to the Alexa Skill Enablement API. When you call this API, you must use one of the following access tokens:
  • The token that you received when you set up app-to-app account linking for the customer.
  • (Smart home add-ons only) The token that you received from the AcceptGrant directive after mutual authentication.
When you make an Enable skill and account link request to the Alexa Skill Enablement API, the user’s account is relinked and you receive a HTTP 201 Created response.
You can subscribe to the Account Linked event.
If a user has an Amazon account but isn’t an Alexa user, they can sign in to the LWA page with their Amazon credentials and then acknowledge the linking request. If a user doesn’t have an Amazon account, they can create a new Amazon account on the LWA screen and complete account linking for the skill. To use Alexa features, the user needs an Alexa-enabled device or Alexa app.
Disabling the skill unlinks the user’s account. As with any skill, a user can say, “Alexa, disable {skill name}” or disable the skill from the skill’s detail page. You can disable the skill and unlink the account for the user by making a Disable skill and unlink account request to the Alexa Skill Enablement API.
To get notified when a user disables your skill, you can subscribe to skill disabled events. When the skill is disabled, you should revoke your access token and delete the Amazon access token for the user. Alexa also deletes the access token that your service provided, and revokes the Amazon access token.
Permissions (such as device address and user profile information) are currently not part of this account linking flow. When the user invokes the skill with an intent that needs permissions, you must prompt the user, through a permissions card, for the respective permissions during runtime.However, when a user links their account through the Alexa-initiated app-to-app account linking flow, they’re prompted to grant permissions. You can grant the required permissions by using that flow.
You must generate the user’s authorization code by using your authorization server. In the traditional account linking flow, the OAuth server generates the authorization code when the user logs in to your service and provides consent to link with Alexa. In App-Initiated App-to-App Account Linking where the user is already logged in, you programmatically generate a new authorization code for the user from your OAuth provider. You must not require the user to log in and provide consent again.

​
App-to-app account linking starting from the Alexa app

The following are frequently asked questions about app-to-app account linking from the Alexa app.
Your authorization URIs must be able to open different apps. Each platform handles this differently as follows:
  • iOS – Add the domain of the authorization URI to the entitlements file of every app that can handle the account linking request. In the Apple App Association File of the domain, add a separate entry for each app. If a user has more than one of the apps installed, the order of their appearance in the Apple App Association File determines the order of preference.
  • Android – Add the domain of the authorization URI to the app manifest of every app that can handle the account linking request. In the Asset Links JSON of the domain, add a separate entry for each app. If a user has more than one of the apps installed, the Intent Filter Priority in your app manifest determines the preference.
Yes. You can either use the same authorization URI for every skill or configure separate authorization URIs for each skill and enable Universal Links or App Links for each one.
Yes, but only if your authorization server exposes an API that generates authorization codes or access tokens by using a session identifier without requiring the user to log in again.
Yes. The post-linking experience is the same as in the standard account linking flow.
The Alexa app sends requests to your app when the user has a version of the Alexa app that supports the app-to-app account linking flow.
Disabling the skill unlinks the account. Users can say, “Alexa, disable <skill name>” or disable the skill from the detail page.
If you enable the Send Alexa Events permission, your Lambda function must handle the AcceptGrant directive. If it doesn’t handle the directive, account linking fails when the user attempts to enable your skill. For details, see Request Access to the Alexa Event Gateway.
Last modified on October 2, 2026