# Production Certification — [App Name]

> **How to use this template:** replace every `[bracketed]` placeholder, check
> each honest box by changing `[ ]` to `[x]` (this document is an attestation),
> and delete the quoted guidance blocks before submitting. Send the completed
> document to partner-support@contio.ai or your shared Slack channel, together
> with a request for production certification.

**Submitted by:** [Name], [Title] — [Company Name]
**Contact:** [primary-contact@company.com]
**Date:** [YYYY-MM-DD]
**App version / release being certified:** [e.g., v1.4.0, or "main @ abc123"]

---

## 1. App Overview

> What does your app do, and what does the Contio integration add? This section
> sets the agenda for the certification demo — list the use cases you will walk
> through live.

[One-paragraph description of the application and its Contio integration.]

**Primary use cases** (these define the demo agenda):

1. [e.g., A mutual user connects their Contio account and we import action items into Acme Tasks]
2. [...]
3. [...]

## 2. Integration Surface

> Which parts of the Partner API does the app use?

### OAuth scopes requested

| Scope | Why the app needs it |
|-------|----------------------|
| [e.g., `meetings:read`] | [e.g., display upcoming meetings in the dashboard] |
| | |

### Partner API endpoints used

[e.g., `GET /v1/partner/user/meetings`, `POST /v1/partner/user/action-items`]

### Webhook events consumed

[e.g., `action_item.created`, `meeting.completed` — or "none"]

### Admin API usage

[Does the app use the Admin API (automations, credential status, etc.)? Describe, or "none".]

## 3. Quality Assurance

> How do you know the integration works, and how do you keep it working?
> Bullet points are fine.

- **Automated testing:** [e.g., unit + integration tests run in CI; the OAuth callback and webhook handlers are covered]
- **Staging environment:** [e.g., staging deployment points at beta.api.contio.ai for pre-release verification]
- **OAuth flow coverage:** [how the connect / callback / token refresh path is tested]
- **Webhook coverage:** [how signature verification and event handling are tested]
- **Release process:** [e.g., PR review + CI + staged rollout; hotfix path]

## 4. Security

> Where do secrets and user data live? Be concrete — "secrets in AWS Secrets
> Manager, tokens encrypted at rest in Postgres" is the level of detail we need.

- **Credential storage:** [where the client secret, API key, and webhook secret are stored — e.g., a secrets manager, never in source or client bundles]
- **User token storage:** [how OAuth access/refresh tokens are stored at rest, and any encryption]
- **Contio data handling:** [what user data is stored, where, and for how long]
- **Disconnect handling:** [what happens to a user's data when they revoke the connection]
- **Security/incident contact:** [email or alias that reaches the team responsible]

## 5. Operations

- **Support contact for mutual users:** [email or URL]
- **Monitoring:** [how you detect webhook delivery failures, API error spikes, token expiry problems]
- **Credential rotation:** [how you would roll a rotated API key / client secret / webhook secret into production]
- **API versioning:** [how you track and adopt new Partner API versions — see the API Versioning guide]

## 6. Production App Registration

> We use this to provision your production partner app. Production values may
> differ from beta — double-check redirect URIs and the webhook URL. The last
> column shows how each field is changed after go-live: self-serve via the
> Admin API, or Contio-managed via a request to the team.

| Field | Value | To change later |
|-------|-------|-----------------|
| App name | [shown on the OAuth consent screen] | Self-serve: `PATCH /v1/partner/admin/app` |
| Description | [one line — what the app does] | Self-serve: `PATCH /v1/partner/admin/app` |
| Company name | | Contact Contio |
| Primary contact email | | Contact Contio |
| Support contact email | [optional] | Contact Contio |
| Redirect URI(s) | [production HTTPS URIs, one per line] | Contact Contio |
| Webhook URL | [production HTTPS endpoint, or "none"] | Self-serve: `PATCH /v1/partner/admin/app` |
| Co-brand name | [optional — display name for co-branded surfaces] | Contact Contio |
| Co-brand logo URL | [optional — HTTPS URL to a hosted logo] | Contact Contio |
| Preferred slug | [optional — lowercase, hyphenated, 3–63 chars] | Self-serve: `PATCH /v1/partner/admin/app` |

## 7. Attestation

- [ ] The information in this document is accurate as of the submission date.
- [ ] Each item on the published demo checklist works against the beta environment today.
- [ ] We will notify Contio before: requesting additional OAuth scopes, changing redirect URIs or co-branding, shipping a materially new use case, or adopting a new Partner API version.

**Signed:** [Name] — [Title] — [Date]