Amazon told at least some sellers on September 15, 2026 that passkeys will become mandatory on a rolling basis starting in two weeks. That points to a rollout beginning around September 29, although the email did not give one universal conversion date for every account.

The message applies the requirement to Amazon accounts including Seller Central and Amazon.com. Once an account is enrolled, its password will remain available for recovery but will no longer be accepted for ordinary login. For an ecommerce business, this is an account-access project, not a setting to leave until the next person is locked out.

Amazon is moving from optional to required

Amazon had already warned sellers in June that passkeys were available and would become required for some accounts later in 2026.

The September 15 seller email reproduced publicly adds the operational details. Amazon says a passkey uses a device’s existing authentication, such as a fingerprint, face scan or PIN. It recommends creating passkeys on at least two devices and says they can sync through an Apple, Google or Microsoft account.

The staged rollout deserves emphasis. Sellers who did not receive the email should not assume the requirement is false, but they also should not treat September 29 as a guaranteed cutoff for every account and region. Check Login & Security inside Seller Central and preserve the email sent to your own account.

Shared passwords have to go

The biggest business change is not the fingerprint prompt. It is Amazon’s instruction for shared accounts.

The email says each additional person must be registered as a secondary user, then create a separate passkey. It also says a new secondary user needs an email address that has not been used on another Amazon account. That means an employee, agency or virtual assistant should not keep using the primary account owner’s login.

This is overdue from a security standpoint, but it can expose messy operating habits. Many brands still have one credential circulating among founders, warehouse staff and agencies. A passkey attached to one person’s phone or cloud account makes that arrangement harder to maintain and much harder to recover when the person leaves.

Create a user map before the rollout. Record every person who signs in, the work they perform, the marketplaces they access and the minimum permissions they need. Remove dormant users and give each active operator a named secondary account. Do not grant administrator access simply because it is quicker.

Remote teams need an extra device and connectivity check. EcomCrew’s discussion of internet access, electronics and remote work for Philippine ecommerce teams is useful context for deciding whether each operator has a supported device and a reliable backup connection.

Two devices are useful only if you test both

Amazon recommends passkeys on at least two devices. Follow that advice, but think about what can fail.

Two phones that both depend on the same inaccessible cloud account may not give you the independence you expect. A laptop and phone can still fail together if nobody knows the device PIN, the employee who controls them is unavailable or the business loses access to the email account used for recovery.

Set up the primary passkey from a known, updated device. Add a second supported route, then test both in a private browser session before deleting any old operating procedure. Record who controls each device or synced credential and what happens when that person is unavailable.

Do not send passkeys, QR codes or screen-share access to a stranger claiming to be Amazon support. Start from Seller Central’s Login & Security page rather than a link in an unexpected message.

One seller in the public discussion reported being caught in a QR-code loop and temporarily unable to use Seller Central on a supported phone. That report is anecdotal and does not establish a widespread outage. It does show why the first test should happen before a shipment deadline or promotion launch.

Build a recovery drill before Q4

The copied email says Seller Support will respond to passkey problems within 24 hours and can restore access after identity verification. That is Amazon’s stated service expectation, not a guaranteed recovery time for your case.

A day without Seller Central can still be expensive for a seller-fulfilled business. EcomCrew’s breakdown of Amazon’s tighter SKU-level handling-time rules explains why losing access while orders are waiting can quickly threaten dispatch performance.

Write a one-page recovery runbook. It should identify the primary account owner, secondary administrators, recovery email and phone, business documents used for verification, and the person authorized to open a support case. Store it somewhere the team can reach without Seller Central.

Also test the Amazon Seller app, the browsers used in the warehouse and any dedicated order workstation. API integrations normally authenticate separately, so a passkey should not automatically break an authorized app, but confirm that with each provider. Do not confuse an integration token with a human login.

The immediate action is simple: inspect Login & Security, create a second tested passkey, and replace every shared login with a named secondary user. The next material detail to watch is Amazon’s account-by-account enforcement prompt, especially whether it publishes a firm regional schedule or an exception process for unsupported devices.