Review and directory

The statuses of an app#

Submitting#

1. 1

   Work through the checklist

   You can only submit once everything is done: name (2 to 60 characters), logo, description, website, privacy policy address, support e-mail, at least one valid redirect URI (an https address for a confidential app), a connection to your test restaurant, at least one request with status 2xx in the last 14 days and, if your app has a webhook, at least one successful delivery in the last 30 days.

   Console › App › Review

2. 2

   Submit for review

   The status changes to “In review”. During that time the app cannot be edited. Until Flavoso has decided, “Withdraw submission” takes it back to development.

   Console › App › Review

3. 3

   Wait for the decision

   Usually a few working days. The decision arrives by e-mail; a rejection includes the reason. Then you edit the app and submit it again.

What is reviewed#

• The details are complete and the addresses reachable.
• Name and logo are not misleading: no third-party brand, no impression that the app is made by Flavoso.
• The app only requests the scopes it needs for its purpose.

Checklist before submitting#

• You have run through the whole flow with the test restaurant: connect, orders, menu, error cases, disconnect.
• Tokens are stored encrypted on your server, the client secret never in an app or a browser.
• Each connection's refresh token is refreshed in exactly one place, and the new one is always stored.
• Webhook signatures are verified, duplicates detected by id.
• Every POST carries an Idempotency-Key; 429 and 5xx are retried with increasing delays.
• livemode: false never ends up in real data.
• app.disconnected and invalid_grant on a refresh lead to a clear message with “Connect again”; unauthorized_client shows “temporarily suspended” and keeps the tokens.
• Your software shows which restaurant it is connected to and can disconnect (DELETE /connection).
• Someone reads the support address.

After approval#

Once your app is approved, every owner can connect it, and the consent screen shows “Reviewed by Flavoso”.

• Apply immediately: changes to the description and the support e-mail, and a removed redirect URI.
• Wait for a new review: name, logo, website, privacy policy address, new redirect URIs, additional scopes and new app directory details (category, tagline, install address). Until then, the reviewed version applies.

The app directory#

Every approved app is listed in the app directory, where restaurants find it: in the dashboard under Settings, Integrations, and publicly at flavoso.com/<language>/integrations. That way a restaurant sees what it can connect. You maintain the entry in your app's settings, and it is part of the checklist before you submit:

Only approved apps appear in the directory, and every one of them does. An approved app cannot be unlisted; if you no longer want to offer it, delete it. If an app is suspended, its entry disappears.

The Flavoso brand#

• Write Flavoso like this: one word, capital F. Not as part of your app's name in a way that sounds like Flavoso itself (“Flavoso POS”); “POS X for Flavoso” is fine.
• The Flavoso logo is not your app's icon.
• “Reviewed by Flavoso” is shown only by Flavoso, on the consent screen and in the directory. Do not claim a partnership, certification or endorsement that does not exist.
• The button says “Connect with Flavoso” (for other languages see Authentication).

Suspension#

If an app breaches the developer terms or is used for abuse, Flavoso can suspend it. Its tokens are then refused with 401, deliveries are skipped, and nobody can connect it again. Its connections remain: when Flavoso lifts the suspension, everything carries on.

During that time the token endpoint answers a refresh with 400 unauthorized_client, not with invalid_grant. Keep the tokens, show “temporarily suspended” and try again later. Events from the time of the suspension can be missing, even in GET /events, without gap saying so. So after the suspension ends, reconcile through the lists, for example with GET /orders?updated_since=….

Deleting an app#

You delete your app in its settings. This ends all its connections, and no token of the app works any more. This cannot be undone; for a fresh start you create a new app.