Partner integrations work best when the ownership boundary is clear.
Onyx controls the account, consent, trust, connectivity, and policy checks that belong to Onyx. Partners control the product experience they build around approved Onyx capabilities.
What Onyx Owns
Onyx owns:
- Onyx account state
- Onyx ID
- consent records
- trust assertions
- connected-app permission state
- communication permission checks
- app-linked message policy
- connectivity provisioning where approved
- activation state where connectivity is used
- usage visibility from Onyx systems
- Onyx policy and compliance controls
Onyx also controls whether a partner can use a capability in preview or production.
What Partners Own
Partners own the experience they present to their customers.
Depending on the integration, partners may own:
- app onboarding
- retail checkout
- customer-facing copy
- app account state
- partner-side support intake
- refund or credit handling above the Onyx-approved policy
- webhook endpoint security
- token handling
- logs created by the partner system
- user education inside the partner product
Partners should not present Onyx capabilities as available until Onyx approves them for the partner account.
Consent Responsibilities
Partners must request only the access they need.
Consent copy should explain:
- the app requesting access
- the requested scopes
- the intended use
- whether the request expires
- how the user can revoke access
Partners must stop using access after revocation or expiration.
Connectivity Responsibilities
For partner connectivity, Onyx can manage provisioning, service state, activation materials, usage visibility, and eligibility controls.
Partners can manage:
- product placement
- customer purchase flow
- retail price where permitted
- customer communication
- first-line troubleshooting
- escalation to Onyx when Onyx action is required
Partners should not promise coverage, speed, number service, or market availability beyond the approved catalogue and launch terms.
Support Responsibilities
Partners should give users a clear self-serve path before escalation.
Partner support should check:
- account state
- consent state
- order state
- activation state
- app configuration
- current availability
Escalate to Onyx only when the issue requires Onyx account, consent, connectivity, provisioning, webhook, or policy review.
Safety Boundaries
Partners must never ask users to expose:
- one-time codes outside approved secure flows
- private keys
- recovery phrases
- wallet secrets
- full card details
- private identity documents outside approved verification flows
Partners should collect only the information needed to resolve the current issue.