Use this checklist before moving an partner integration into production.
Production access should not start until the app, consent, events, support path, privacy posture, and any connectivity flow are ready.
App Identity
Confirm:
- app name is configured
- app description is clear
- app ownership is verified
- production domain is verified
- allowed origins are correct
- redirect URIs are configured
- preview credentials are separate from production credentials
Consent And Scopes
Confirm:
- requested scopes match the feature
- consent copy is clear
- user can allow or decline
- user can revoke access
- expired access stops working
- denied access has a clear state
- connected-app visibility works for the granted scope set
Sign-In Flow
Confirm:
- login completes successfully
- the app handles failed login
- the app handles expired sessions
- the app stores session state safely
- login does not assume messaging permission
Messaging And Events
Confirm:
- reachability checks run before send
- pre-send checks run before live messages
- blocked sends show reason codes
- webhook endpoint is configured
- webhook signing is validated where required
- test events are delivered
- retry handling is idempotent
Partner Connectivity
If the integration uses Partner Connectivity, confirm:
- catalogue version is current
- unavailable packages are hidden or disabled
- order creation is tested
- provisioning state is visible
- activation guidance is current
- usage state is visible for the service flow
- support escalation path is ready
Support Readiness
Confirm:
- partner support knows first checks
- escalation criteria are documented
- support evidence excludes sensitive material
- user-facing support copy is accurate
- refund or credit rules match the partner agreement
Privacy And Security
Confirm:
- the app requests only needed scopes
- tokens are protected
- webhook secrets are protected
- logs avoid sensitive data
- identity documents stay inside secure verification flows
- the privacy notice explains partner data handling
Launch Readiness
Onyx can require final readiness review before production traffic starts.
Do not launch a gated capability until Onyx confirms that it is enabled for the partner, market, and environment.