Going to production

The checklist before you submit your app for review, and what changes once it is live.

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

The checklist

• Redirect addresses for the live client: https only, or an app scheme for a public app, each on a domain your team verified. Never localhost.
• Least scope: ask for only what the app uses. Each sensitive scope (age, membership, wallet, licences, creator) needs a reason we can see in your app.
• A homepage and a privacy policy on https, the policy saying what you do with what you receive from Atheron.
• Your name and logo are yours, and do not use Atheron, ATON or our product names.
• Verification: every owner of the team has reached Bedrock verification, or the team's business has passed its check. A business check also gives your consent screen a verified badge.
• Secrets are in your server's environment, never in a repository or a browser. Rotate any that were ever shared.
• Webhooks for the live environment, if you use them, with signatures checked.
• Rate limits: read your tier's limits on the app's API keys page and back off on 429.
• Errors: every error code you can meet has a path in your app. See Errors.

Submit

On the app's Go live page, submit for review. A person reviews every app and writes the reason you see. See Review and going live for what we check.

Once it is live

Anybody with an Atheron account can sign in. Changing the name, logo or links, or adding a sensitive scope, goes through review again; your test client shows changes at once, so build them there first.