Production Certification¶

Certification is the lightweight review that moves your partner app from the beta (sandbox) environment to production. This page explains what's involved, what we look for, and how to prepare.

Environments at a Glance¶

Each environment has its own partner app and its own credentials. Your beta app stays active after you go live — treat it as your permanent test environment for validating changes and adopting new API versions.

Why Certification Exists¶

The OAuth consent screen shows your app's name to our users, and production access means acting on their behalf. Certification is how we make sure that trust is well placed — for your users and ours.

It is deliberately lightweight:

• It is a working demo, a short verified checklist, and a written self-attestation about your QA and security practices.
• It is not a security audit, a penetration test, or a code review. We don't ask for test artifacts, source code, or certifications from third parties.

The Process¶

flowchart LR
    A["1. Submit request<br/>(registration info +<br/>self-cert doc)"] --> B["2. Demo &amp; review<br/>(~30 min call,<br/>verified checklist)"]
    B --> C["3. Production<br/>credentials issued"]

Step 1 — Submit Your Certification Request¶

Send the following to partner-support@contio.ai, or post it in the shared Slack channel if we set one up with you during development:

1. The completed self-certification document — use the template below, or download it as Markdown. It covers your use cases, the API surface you use, and your QA, security, and operations posture. Section 6 of the template collects the registration details we need to provision your production app (production redirect URIs, webhook URL, contacts, and optional co-branding) — production values often differ from beta, so double-check them.
2. A request for certification — a line saying you're ready to schedule the demo is fine.

Step 2 — Demo & Review¶

We read your document, then schedule a ~30 minute call where you walk us through your app's primary use cases live against the beta environment. During the demo we verify the checklist below — each item is pass/fail, and we'll tell you the result on the call.

If something doesn't pass, there's no penalty: fix it, and we re-demo just the failed items.

Step 3 — Production Credentials¶

Once the checklist passes, we provision your production partner app and issue a separate set of credentials (client ID/secret, API key, webhook secret). Swap your base URL to https://api.contio.ai and your beta credentials for the production ones — that's the whole migration.

The Demo Checklist¶

These are the only things we verify. Everything on this list exists because it has a direct impact on mutual users or on the platform.

The Self-Certification Template¶

Everything below is the template verbatim. Copy it into your own document tool, or download the Markdown file and fill it in directly — it's plain Markdown with [bracketed] placeholders and checkboxes, so it's equally easy for a person or an agent to complete.

After Certification¶

Certification is one-time, and day-to-day app management is self-serve.

Manage your app yourself¶

These changes need no approval — apply them whenever you like with your API key:

Changes we manage for you¶

A small set of fields is Contio-managed — reach out on your usual channel (email or shared Slack) to change them:

• Redirect URIs — they gate the OAuth callback. An unvetted URI is an open-redirect / code-interception risk, and a wrong one breaks the connect flow for every user.
• Company name and contact emails — used for support routing and our records.
• Co-branding (name + logo) — appears on Contio-facing consent surfaces.
• Workspace plan — set at provisioning time.

These should change rarely, which is the point of the split: fields where a misconfiguration could break mutual users or create a security issue go through us; everything operational stays in your hands.

Keep us in the loop¶

Beyond the managed fields above, tell us before you

• request additional OAuth scopes (they change what the consent screen promises users),
• ship a materially new use case, or
• adopt a new Partner API version.

FAQ¶

How long does certification take? The review of your document is asynchronous, and the demo is one ~30 minute call — the timeline is mostly scheduling. Submitting a complete template keeps it to one round-trip.

What if we fail a checklist item? We tell you what didn't pass and why. Fix it and we re-demo just that item — no full restart.

Does our beta app keep working after we go live? Yes, and we recommend keeping it that way. Use it to test changes and new API versions before they touch production users.

Do we re-certify when you release a new API version? No. Certification is one-time; adopting a new version just requires the heads-up described above.

Is there an automated conformance test suite? Not today. The checklist above is verified in the demo. We expect the process to mature as the program grows, and this page will always reflect the current requirements.

Next Steps¶

• Download the certification template
• Credential Management — rotating production credentials safely
• API Versioning — how Partner API versions and deprecations work
• Webhook Management — signature verification and delivery semantics