{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-getting-started/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Production readiness"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"production-readiness","__idx":0},"children":["Production readiness"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["This page applies to Partners."]}," Clients accessing their own data do not go through a production review — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/getting-started/integration-models"},"children":["Integration models"]}," if you are not sure which applies to you."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before your integration is promoted to production, three things must be complete:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An application review"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A signed Partner Agreement"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A completed security assessment"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page sets out what each involves, so you can prepare rather than discover the requirements one at a time. Reading it early is worthwhile — several of these items are easier to build in than to retrofit."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Production uses different credentials and a different base URL to the sandbox. You will be issued separate production credentials once approved — your sandbox credentials will not work against production."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"application-review","__idx":1},"children":["Application review"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["We will ask you to walk us through your application and its integration. Contact us at ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"mailto:partners@class.com.au"},"children":["partners@class.com.au"]}," to arrange a session."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"demonstration","__idx":2},"children":["Demonstration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Show us the integration working end to end, from a user's perspective."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"architecture","__idx":3},"children":["Architecture"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Provide a diagram showing how your application connects to our APIs, where it runs, and where data is stored."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"security","__idx":4},"children":["Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm the following:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["All interactions and redirects use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your application uses the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}," parameter on authorisation requests to mitigate CSRF attacks."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your application requests the minimum set of permissions it needs, and no more."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your application uses refresh tokens where appropriate, rather than sending users through the authorisation process repeatedly."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You have supplied the IP addresses your requests will originate from."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"api-usage","__idx":5},"children":["API usage"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tell us:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Which endpoints your application will call."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["How many businesses you expect to be connected."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Expected request volume per day, how requests are initiated (user-triggered, scheduled or batch), and how that volume is distributed across the day."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"rate-limiting","__idx":6},"children":["Rate limiting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your integration must stay within the published rate limits for the product you are integrating with, and must handle throttling responses correctly. Confirm:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["That your expected volume stays within the published limit."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["How your application backs off when it receives an HTTP ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["429"]}," response."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If your calls are automated, how they are scheduled or queued to avoid volume spikes."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Rate limits and the response headers that support back-off are documented in each product's resources."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"error-handling","__idx":7},"children":["Error handling"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["That your application handles API errors gracefully, including when a user cancels the authorisation process."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your retry strategy — in particular, whether a failure within a batch retries the single request or restarts the whole process."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-management","__idx":8},"children":["Token management"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Describe how your application handles tokens:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Storage"]}," — where access tokens are held, and in what form."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh tokens"]}," — how they are stored and managed, and your process for exchanging one for a new access token."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protection"]}," — what prevents tokens from being exposed or compromised."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Re-authorisation"]}," — what happens when a refresh token expires or is revoked, and how the customer re-authorises your application."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"signed-partner-agreement","__idx":9},"children":["Signed Partner Agreement"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your Partner Agreement must be signed before production credentials are issued. Your Partnerships contact will manage this alongside the review — it does not need to wait for the review to finish."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-assessment","__idx":10},"children":["Security assessment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You will complete an assessment covering how your organisation and application protect data. Your Partnerships contact facilitates this, and it is reviewed by our IT Security and Cyber teams."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The assessment covers three areas:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organisation and application"]}," — company details, where your application is hosted, data centre locations, third parties involved in delivering your service, and how often you conduct penetration testing."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Certifications"]}," — any verifiable certification or independent audit report you hold, such as ISO 27001, SOC 1, SOC 2, SOC 3 or PCI-DSS, or your status as a Digital Service Provider with the ATO."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Controls"]}," — key management, encryption in transit and at rest, multi-factor authentication, indirect access to data, vulnerability management, audit logging, hosting location, security monitoring, backups and incident management."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once the assessment is complete, our Compliance and Cyber Security teams review it. On successful review, your production credentials are approved and issued."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These controls are subject to annual audit under the terms of your agreement."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"after-approval","__idx":11},"children":["After approval"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You will receive production credentials and can deploy. If you want support promoting your integration to our client base, speak to your Partnerships contact."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"product-resources","__idx":12},"children":["Product resources"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Technical requirements referenced above — rate limits, token lifetimes, error responses — are documented per product:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/hub24/apis"},"children":["HUB24"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/class/resources/overview"},"children":["Class"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/overview"},"children":["NowInfinity"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/myprosperity/apis"},"children":["myprosperity"]}]}]}]},"headings":[{"value":"Production readiness","id":"production-readiness","depth":1},{"value":"Application review","id":"application-review","depth":2},{"value":"Demonstration","id":"demonstration","depth":3},{"value":"Architecture","id":"architecture","depth":3},{"value":"Security","id":"security","depth":3},{"value":"API usage","id":"api-usage","depth":3},{"value":"Rate limiting","id":"rate-limiting","depth":3},{"value":"Error handling","id":"error-handling","depth":3},{"value":"Token management","id":"token-management","depth":3},{"value":"Signed Partner Agreement","id":"signed-partner-agreement","depth":2},{"value":"Security assessment","id":"security-assessment","depth":2},{"value":"After approval","id":"after-approval","depth":2},{"value":"Product resources","id":"product-resources","depth":2}],"frontmatter":{"title":"Production readiness","description":"What we assess before your integration is approved for production, and how to prepare for it.","seo":{"title":"Production readiness"}},"lastModified":"2026-09-03T00:32:02.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/getting-started/production-readiness","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}