Use this checklist before moving an approved partner integration into production.
Production access should not start until the app, consent, events, support path, privacy posture, and any connectivity flow are ready.
App Identity
Confirm:
- app name is approved
- app description is clear
- app ownership is verified
- production domain is verified
- allowed origins are correct
- redirect URIs are approved
- preview credentials are separate from production credentials
Consent And Scopes
Confirm:
- requested scopes match the feature
- consent copy is clear
- user can approve or decline
- user can revoke access
- expired access stops working
- denied access has a clear state
- connected-app visibility works where supported
Sign-In Flow
Confirm:
- login completes successfully
- the app handles failed login
- the app handles expired sessions
- the app stores session state safely
- login does not assume messaging permission
Messaging And Events
Confirm:
- reachability checks run before send
- pre-send checks run before live messages
- blocked sends show reason codes
- webhook endpoint is configured
- webhook signing is validated where required
- test events are delivered
- retry handling is idempotent
Partner Connectivity
If the integration uses Partner Connectivity, confirm:
- catalogue version is approved
- unavailable packages are hidden or disabled
- order creation is tested
- provisioning state is visible
- activation guidance is approved
- usage state is visible where supported
- support escalation path is ready
Support Readiness
Confirm:
- partner support knows first checks
- escalation criteria are documented
- support evidence excludes sensitive material
- user-facing support copy is accurate
- refund or credit rules match the partner agreement
Privacy And Security
Confirm:
- the app requests only needed scopes
- tokens are protected
- webhook secrets are protected
- logs avoid sensitive data
- identity documents stay inside approved verification flows
- the privacy notice explains partner data handling
Launch Approval
Onyx can require final approval before production traffic starts.
Do not launch a gated capability until Onyx confirms that it is enabled for the partner, market, and environment.