Setup guide · free Feedback Manager

From download to
first feedback fetch.

Install the app on your server, give your own private Amazon app the minimum role it needs, test the connection and schedule the official 1–3★ feedback report.

Before you start

Have these ready

Your hosting

  • PHP 8.1+ with PDO MySQL, cURL and OpenSSL
  • Empty MySQL/MariaDB database and user
  • HTTPS URL not shared with the public
  • Command-line cron-job access
  • Amazon professional seller account
  • Seller Central Primary user
  • Apps & Services → Develop Apps access
  • A truthful Amazon developer profile and security answers
Data responsibility stays with you. The report contains confidential seller information and order IDs. Host it securely, keep PHP and the server patched, restrict administrator access and include both the database and config.php in protected backups.
1

Download and upload the folder

Download version 1.0.0, unzip it and upload the whole feedback-manager folder to your own hosting. Use a private path under an HTTPS domain. Do not put the zip, database backup or a copy of config.php in a publicly downloadable folder.

2

Run the three-step installer

Open https://your-domain.example/feedback-manager/install.php. The first screen checks PHP, extensions, HTTPS and write access. Then enter the empty database details and create a 12+ character administrator password.

The installer generates a unique 256-bit credential-encryption key and writes it to config.php. It then attempts to delete itself. If it cannot, delete install.php manually when instructed.
3

Create a private Amazon SP-API app

Sign in to Seller Central as the Primary user, open Apps & Services → Develop Apps, complete Amazon's developer registration if needed and create a private SP-API app for your own organisation.

Select Selling Partner Insights. Amazon also maps the feedback report to Amazon Fulfillment, but Selling Partner Insights is the narrower performance-information fit. Do not add restricted order/address roles for this Manager.

Use truthful security answers. This app is self-hosted and stores rating, comment, seller response and order ID on your server. It discards the report's rater-email field.
4

Self-authorise and copy the three LWA values

Open the app's LWA credentials and copy the full Client ID and Client Secret. Choose Authorize app for your seller account and copy the resulting Refresh Token. Do not email them, paste them into support messages or include them in screenshots.

5

Test before saving

Log in to the Feedback Manager, open Amazon connection, enter the three credentials and tick only the marketplaces you actually sell in. Choose Test and save. The Manager mints a short-lived access token and checks marketplace participation. Credentials are saved only after that succeeds.

Saved values use authenticated AES-256-GCM encryption. The key is outside the database in config.php, so a database-only leak does not reveal the credentials.

6

Add the daily command-line cron

Open Settings and copy the exact command shown under Daily schedule into your hosting control panel. Schedule it once per day at a quiet time. The job uses a database lock, so a manual fetch cannot overlap it.

No URL token is provided. Command-line cron prevents a reusable secret from appearing in browser history, referrer headers or web-server access logs.
7

Run the first fetch and read the result correctly

Choose Fetch now. Amazon creates one report per marketplace and applies a strict create-report rate limit, so a multi-country run can take several minutes. A marketplace Amazon marks CANCELLED can simply mean there was no negative or neutral feedback in the requested window; the Manager records that as empty, not as a failure.

1–3★ only. The official report does not contain 4–5★ positive feedback. The dashboard is a needs-attention queue, not a complete feedback ledger.
8

Back up and operate it

Back up the MySQL database and config.php together to protected storage outside the web root. Review unseen and unanswered rows, open associated orders in Seller Central, and export filtered CSV when needed. Formula-leading CSV cells are neutralised.

If you enable email alerts, the message contains a count only. Your server must have PHP mail configured; feedback text and order IDs remain in the dashboard.

Troubleshooting

The usual causes

Invalid grant

Re-copy all three LWA values. If the refresh token was revoked, self-authorise again and save the new token.

403 from Amazon

Confirm Selling Partner Insights is approved on the developer profile and app, then re-authorise so the refresh token includes it.

Report is empty

This is often correct: Amazon returns no document when there is no 1–3★ feedback in the explicit lookback window.

Manual fetch will not start

Your host may disable background exec. Run the Settings cron command directly; daily cron remains the reliable route.

Email not received

Count alerts depend on your host's PHP mail configuration. The feedback fetch itself is unaffected.

Locked out

Wait 15 minutes after repeated failures, or run the included interactive tools/reset-password.php command.

Ready to install?

The software and this guide are both free.

Download version 1.0.0Product page