[Python] Amazon SP-API sandbox Orders API returns 403 Unauthorized despite LWA token and SigV4...

I'm testing the Amazon Selling Partner API (SP-API) using the sandbox environment, specifically the GET /orders/v0/orders endpoint.

Despite including both the LWA access token and signing the request with SigV4 using temporary credentials from AssumeRole, I am still getting the following error:

{
"errors": [
{
"code": "Unauthorized",
"message": "Access to requested resource is denied.",
"details": "Access token is missing in the request header."
}
]
}

Request Details:
• Endpoint:
https://sandbox.sellingpartnerapi-na.amazon.com/orders/v0/orders?CreatedAfter=TEST_CASE_200&MarketplaceIds=ATVPDKIKX0DER

Headers:
x-amzn-access-token: <valid LWA token>
x-amz-security-token: <from AssumeRole>
x-amz-date: <in YYYYMMDD'T'HHMMSS'Z' format>
Host: sandbox.sellingpartnerapi-na.amazon.com
Accept: application/json
Authorization: AWS4-HMAC-SHA256 ... (generated with SigV4)

Auth flow:
1. Get LWA token using refresh token, client ID, and client secret.
2. AssumeRole using long-term AWS access key and secret key.
3. Sign the request with botocore’s SigV4Auth.


Code:

I’m following this basic structure:
# Get LWA token
# Assume role
# Sign request using SigV4Auth from botocore.auth
# Send with requests.Session().send()


What I’ve checked:
• LWA token is valid and not expired.
• Temporary credentials from AssumeRole include session token.
• All required headers (including x-amzn-access-token) are correctly set.
• Endpoint, query parameters, and service name are accurate.
• SigV4 signature is freshly generated for each request.

Questions:
• Is there any known issue with the sandbox and GET /orders/v0/orders?
• Is it possible the sandbox rejects requests even with proper headers for some TEST_CASE values?
• Could the issue stem from a missing permission even in the sandbox?

Any help or clarification is much appreciated!

Continue reading...