Retailer Credentials

Managed accounts (aka retailer credentials) allow you to use your own retailer accounts (e.g., Amazon) for order processing. This gives you control over the accounts used to place orders and can help with order limits and account management.

Overview

When you create retailer credentials, Zinc uses those accounts to log in and place orders on your behalf. Credentials are encrypted and stored securely.

If you don’t configure retailer credentials, Zinc will use default internal accounts to process your orders.

Order Locking

To prevent conflicts and ensure order integrity, managed accounts are locked during order processing. Only one order can be processed at a time per managed account. If you submit multiple orders simultaneously using the same managed account, they will be queued and processed sequentially. This prevents issues like duplicate cart items or checkout conflicts that could occur if multiple orders were placed concurrently on the same retailer account.

Two-Factor Authentication (TOTP)

If your retailer account has two-factor authentication enabled, you must provide the TOTP secret key when creating or updating credentials.

Using 2FA is the most secure and reliable method for avoiding account verification issues during order processing.

Finding Your Amazon TOTP Key

To find your Amazon TOTP secret key:

Go to Amazon’s Login & Security settings
Enable Two-Factor Authentication
When shown the QR code, click “Can’t scan the barcode?”
Copy the displayed secret key (64 characters)

The TOTP key is the 64-character secret key, NOT the 6-digit time-based code that changes every 30 seconds.

Amazon 2FA setup showing where to find the secret key

Email Forwarding

Retailers like Amazon may send verification codes via email during login. To handle these automatically, you can forward emails from your retailer account to a special Zinc email address. Zinc will parse incoming emails and automatically extract verification codes, so orders can proceed without manual intervention. Each managed account is assigned a dedicated forwarding address. You can find this address in the Zinc dashboard under your managed account settings.

Once email forwarding is configured and verified, the has_forwarding field on your managed account will be set to true.

Setting Up Email Forwarding in Gmail

Rather than forwarding all incoming mail to Zinc, we recommend creating a Gmail filter that only forwards emails from the retailer. This keeps your forwarding targeted and avoids sending unrelated emails to Zinc.

Before Gmail can forward to any address, it must be registered. Go to Settings > Forwarding and POP/IMAP and click Add a forwarding address. Enter the Zinc forwarding email address shown in your managed account settings on the Zinc dashboard.Google will send a confirmation email to the Zinc address. Zinc automatically verifies the forwarding request — this may take a few minutes. Once confirmed, the address will appear as verified in Gmail.

Do not enable the “Forward a copy of incoming mail to” option on this page. That would forward all of your email. Instead, leave it set to Disable forwarding and use a filter in the next steps to forward only retailer emails.

Create a new filter

Go to Settings > Filters and Blocked Addresses and click Create a new filter.

Set the filter criteria

In the From field, enter the retailer’s email domain. For example, for Amazon enter amazon.com. This will match all emails sent from any @amazon.com address. Leave the other fields blank and click Create filter.

Set the filter action

Check Forward it to and select the Zinc forwarding address from the dropdown. You can also check Never send it to Spam to make sure retailer emails aren’t missed. Click Create filter to save.

If you also want to forward emails that are already in your inbox (e.g., a pending verification code), check Also apply filter to matching conversations when creating the filter.

SMS Forwarding

Not every challenge arrives by email. Retailers and card issuers often send the one-time code as a text message to the phone number on the account — Amazon sign-in codes, and the card verification (CVC) step some issuers trigger during checkout. Zinc can’t see those messages, so an order stalls on a code sitting in someone’s phone. Send them to the same place: forward the text to the managed account’s fwd-…@buy.zinc.com address using an SMS-to-email app. A forwarded text is parsed exactly like a forwarded email, so no other setup changes.

iOS

SMS Forwarder: Forward SMS — forwards incoming texts to an email address. Paid subscription.

Android

SMS Forwarder (frzinapps) — forwards to email with per-sender and per-keyword filter rules.

Configuring the forwarder

Forward to the managed account's address

Use the fwd-…@buy.zinc.com address shown for that managed account in the Zinc dashboard — the same address you use for email forwarding. Each managed account has its own address, so a phone that receives codes for two accounts needs a rule per account.

Filter by sender

Forward only the senders that carry codes — the retailer’s short code and your card issuer — rather than every text on the phone. Both apps above support filtering on the sending number or on keywords in the message.

Set a fixed subject line

Set the forwarded email’s subject to Verification code. Zinc looks for verification wording in the subject or body before it extracts a code, and the wording in a text message is inconsistent — a fixed subject makes every forwarded code eligible.

Keep digits out of the subject. A number in the subject line is treated as the verification code.

Send the message text, and put it first

Configure the forwarder to send the message body, with any sender or timestamp metadata after it. Short codes are six digits themselves — Amazon’s US short code is 262966 — and a six-digit number appearing above the real code can be picked up instead.

Test the rule before you rely on it: text yourself Your verification code is 123456 from another phone and confirm has_forwarding flips to true on the managed account. The first message Zinc receives at a forwarding address marks it verified.

Endpoints

Method	Endpoint	Description
`GET`	`/managed-accounts`	List all your retailer credentials
`POST`	`/managed-accounts`	Create new retailer credentials
`PUT`	`/managed-accounts/{short_id}`	Update existing credentials
`DELETE`	`/managed-accounts/{short_id}`	Delete credentials

Create Credentials

curl -X POST https://api.zinc.com/managed-accounts \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "your-amazon-email@example.com",
    "password": "your-amazon-password",
    "retailer": "amazon",
    "totp_secret": "YOUR_64_CHARACTER_SECRET_KEY"
  }'

Request Fields

Field	Type	Required	Description
`email`	string	Yes	The email address for the retailer account
`password`	string	No	The password for the retailer account (encrypted on storage)
`retailer`	string	No	Retailer name (e.g., `amazon`). If omitted, applies as default credentials
`totp_secret`	string	No	The secret key for two-factor authentication. Required if 2FA is enabled on the retailer account

Response

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "short_id": "zn_acct_a1b2c3d4",
  "email": "your-amazon-email@example.com",
  "retailer": "amazon",
  "has_totp": true,
  "created_at": "2026-01-15T10:30:00Z",
  "updated_at": "2026-01-15T10:30:00Z"
}

Passwords and TOTP secrets are never returned in API responses. They are encrypted and stored securely. The has_totp field indicates whether 2FA is configured.

List Credentials

curl https://api.zinc.com/managed-accounts \
  -H "Authorization: Bearer <your_api_key>"

Response

{
  "credentials": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "short_id": "zn_acct_a1b2c3d4",
      "email": "your-amazon-email@example.com",
      "retailer": "amazon",
      "has_totp": true,
      "created_at": "2026-01-15T10:30:00Z",
      "updated_at": "2026-01-15T10:30:00Z"
    }
  ],
  "total": 1
}

Update Credentials

Use the short_id from the credentials response to update:

curl -X PUT https://api.zinc.com/managed-accounts/zn_acct_a1b2c3d4 \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "new-password"
  }'

Request Fields

All fields are optional. Only provided fields are updated.

Field	Type	Description
`email`	string	New email address
`password`	string	New password
`retailer`	string	New retailer association
`totp_secret`	string	Update the 2FA secret key

Delete Credentials

curl -X DELETE https://api.zinc.com/managed-accounts/zn_acct_a1b2c3d4 \
  -H "Authorization: Bearer <your_api_key>"

Returns 204 No Content on success.

Response Fields

Field	Type	Description
`id`	string (UUID)	Unique identifier
`short_id`	string	Short identifier used in URLs (e.g., `zn_acct_a1b2c3d4`)
`email`	string	Retailer account email
`retailer`	string or null	Retailer name, or null if default credentials
`has_totp`	boolean	Whether TOTP 2FA is configured for this account
`has_forwarding`	boolean	Whether email forwarding has been verified for this account
`created_at`	string (ISO 8601)	When the credentials were created
`updated_at`	string (ISO 8601)	When the credentials were last updated

Best Practices

Use dedicated accounts - Create retailer accounts specifically for Zinc orders to avoid conflicts with personal orders
Monitor account health - Retailer accounts can be locked if flagged for unusual activity. Check for login_failed or account_locked errors
Keep credentials updated - If you change your retailer account password, update it here to avoid order failures
Enable 2FA - Two-factor authentication prevents account lockouts from verification challenges and is the most reliable method for automated ordering

Getting Started

Agent Sandbox

Search (Beta)

Orders

Bulk Orders

Managed Accounts

Returns

Product Data

Retailers

Agent

Usage

Retailer Credentials

Overview

Order Locking

Two-Factor Authentication (TOTP)

Finding Your Amazon TOTP Key

Email Forwarding

Setting Up Email Forwarding in Gmail

SMS Forwarding

iOS

Android

Configuring the forwarder

Endpoints

Create Credentials

Request Fields

Response

List Credentials

Response

Update Credentials

Request Fields

Delete Credentials

Response Fields

Best Practices

​Overview

​Order Locking

​Two-Factor Authentication (TOTP)

​Finding Your Amazon TOTP Key

​Email Forwarding

​Setting Up Email Forwarding in Gmail

​SMS Forwarding

iOS

Android

​Configuring the forwarder

​Endpoints

​Create Credentials

​Request Fields

​Response

​List Credentials

​Response

​Update Credentials

​Request Fields

​Delete Credentials

​Response Fields

​Best Practices

Overview

Order Locking

Two-Factor Authentication (TOTP)

Finding Your Amazon TOTP Key

Email Forwarding

Setting Up Email Forwarding in Gmail

SMS Forwarding

Configuring the forwarder

Endpoints

Create Credentials

Request Fields

Response

List Credentials

Response

Update Credentials

Request Fields

Delete Credentials

Response Fields

Best Practices