---
updatedAt: 2026-09-09T23:45:37.000Z
agentTools:
  siteIndex: https://developer-docs.amazon/llms.txt
  projectIndex: https://developer-docs.amazon/sp-api/llms.txt
---

# Authorization with the Restricted Data Token

Learn how to authorize SP-API operations that access restricted data.

Some Selling Partner API (SP-API) operations access sensitive information, such as personally identifiable information (PII). These operations are classified as *restricted operations* and require enhanced security through Restricted Data Tokens (RDTs).

## Prerequisites for Using RDTs

Before you can request an RDT:

* Obtain the required restricted <<glossary:role>> access. For details about roles, refer to [Selling Partner API Roles](https://developer-docs.amazon.com/sp-api/docs/roles-in-the-selling-partner-api).
* Ensure that your application needs to perform functions that require PII access, such as shipping, tax invoicing, and so on. To determine whether your application needs restricted operations, browse [Role Mappings for SP-API Operations](https://developer-docs.amazon.com/sp-api/docs/role-mappings) and [Role Mappings for SP-API Types](https://developer-docs.amazon.com/sp-api/docs/role-mappings-for-types) to see if the required roles are marked as restricted.

## How to get an RDT

There are two ways to get an RDT:

* For most applications: Call the [`createRestrictedDataToken`](https://developer-docs.amazon.com/sp-api/reference/createrestricteddatatoken) operation of the Tokens API with a Login with Amazon (LWA) access token.

* For <<glossary:delegatee application>>s: Receive an RDT from the delegator application that your application is integrated with.

For more details on these methods, including delegation, refer to the [Tokens API Use Case Guide](https://developer-docs.amazon.com/sp-api/docs/tokens-api).

## How to use an RDT

To use an RDT:

1. Instead of using an LWA access token, pass the RDT in the `x-amz-access-token header` when you call a restricted SP-API operation.

2. Follow the standard process to [add headers to the URI](https://developer-docs.amazon.com/sp-api/docs/connecting-to-the-selling-partner-api#step-3-add-headers-to-the-uri), but substitute the RDT for the usual access token.

## Important considerations

When you use RDTs, keep the following considerations in mind:

* RDTs are specific to restricted operations and cannot be used for standard SP-API calls.
* Ensure that your application handles RDTs securely due to their access to sensitive data.