Developers
App integration certificationGlobal updates
Pushing or receiving contact updates that propagate globally to merchants and services (beyond "pending user review") requires a certified integration. This protects end users and ensures signing, idempotency, and privacy are done correctly.
What certification covers
- Correct use of TLS and server-only API keys; no secrets in clients.
- Verified webhook implementation (HMAC, clock skew, raw body handling).
- Idempotent contact update submissions where applicable.
- Data handling: scope of data you request and user-visible consent copy.
- Test environment validation against a staging tenant.
Until your app is certified, the API may return pending_user_review or rejected for high-impact flows, depending on policy, instead of processed_globally.