Submission & Review

Before operators can install your app from the marketplace, it must be
submitted, reviewed, and approved by ROLLER. This page describes what to
prepare and what the review checks for so your submission clears the first time.

1. Before you submit — readiness checklist

Your app should already:

Implement the connect/disconnect webhook contract,
including shared-secret validation and idempotent handling.
Store each venue's delivered client_secret encrypted at rest and treat
it as a live credential.
Authenticate via the OAuth2 client-credentials flow
and cache the bearer token correctly.
Request only the scopes it needs (least privilege).
Have passed the sandbox checklist against a Playground
tenant.
Tolerate additive API changes (unknown fields/enums) per the
support policy.

2. What to declare in your submission

Item	Why ROLLER needs it
App name, description, and support contact	Shown to operators in the marketplace listing.
Requested scopes	Displayed to and approved by the operator at install; reviewed for least privilege.
`connect_webhook_url`	Must be `https://`; both `venue.connect` and `venue.disconnect` are delivered here.
Data handling on disconnect	How your app honours the `delete_data` flag when an operator removes it.
Whether the app needs any restricted (Staff) scopes	Restricted scopes require explicit justification and the venue to be enabled for the Staff Management API.

3. What the review checks

ROLLER's review confirms your app is safe for operators to install:

Scope justification — every requested scope is warranted by the app's stated
function; over-broad requests (especially full access or restricted Staff
scopes) are challenged.
Credential handling — the delivered client_secret is stored securely and
never exposed client-side or in logs.
Webhook security — the connect_webhook_url is https://, the shared secret
is validated on every delivery with a constant-time comparison, and the handler
is idempotent.
Disconnect behaviour — the app honours delete_data and stops calling the
API for a disconnected venue.
Support-policy compliance — the app tolerates additive changes and does not
rely on undocumented behaviour.

4. After approval — going live

Once approved, your app is listed and operators can install it. On each install:

The operator triggers the connection and approves your requested scopes.
ROLLER mints a scoped, per-venue client_id / client_secret pair and
delivers it in the venue.connect webhook.
Your app stores the credentials and begins serving that venue.

If your app's approved scope set later changes, existing operators are prompted to
reconnect, which rotates the credential — handle a repeat venue.connect as a
credential rotation (see Integration Apps §6).

5. Updates and versioning

App updates that change the requested scope set go through review again and
prompt operators to reconnect.
API version migrations follow the
support policy: you get at least
90 days' notice before a breaking change, and each major version is supported
for 12 months after its successor ships.

Need help?

Reach out to your Client Success Manager or
ROLLER Support
with questions about submission, scopes, or review status.