Application Promote
What Is It For?
- Ties applications to a path where they are validated on Test before Prod
- Separates TEST and PROD credentials so production keys are not created too early
- Gives approvers context via technical contact, expected traffic, egress IPs, and required documents
- Manages the lifecycle of promoted apps safely with suspend and deletion requests
- Manages product access through the app with a subscription wizard and plan approval
Who Uses It?
- Developers (Owner/Developer): To create apps, subscribe, and request Prod promotion
- Portal / platform administrators: To configure Prod Promotion, document templates, and approvals
- Security / operations: To verify documents and network requirements before Prod access
Access
- Developer Portal: My Apps → application detail (Configuration, Traffic & Usage)
- Manager setting: Portal → Settings → Portal → Prod Promotion
- Related environment URLs: under Features / API Environments, Production API base URL and Sandbox API base URL (address shown to consumers; does not change gateway routing)
Why Promote Exists
Apps created on the portal start as Test only and run with a TEST credential. Production keys are read from a separate prod management connection only after an approved promote, so test keys are not used for production traffic.
Application promotion state
| State | Meaning |
|---|---|
| Test only | Test only; no PROD credentials yet |
| Awaiting prod approval | Promote requested; waiting for approval |
| Prod active | Approved; PROD credentials available |
Manager — Prod Promotion Configuration
| Field | Purpose |
|---|---|
Enable Prod Promotion (enablePromotion) | Shows/hides Prod Promotion configuration fields (connection, documents) in Manager |
| Production instance connection | Separate Apinizer production instance |
| Prod management API URL | Where approved apps/credentials are read from |
| Prod management API key | Stored encrypted; never shown again after save (leave blank = do not change) |
| Requested documents | Name, hint, allowed types, Required/Optional document list |
If no documents are defined, approval alone may be enough (with an info note). Reading PROD credentials requires the prod management URL + key connection.
enablePromotion is mapped to the portal as promotionEnabled. The current Developer Portal UI does not hide the Promote button based on this flag, and submitPromote on the backend does not check it either. The flow follows the app promotion state (Test only → Awaiting prod approval → Prod active). When the toggle is off, Manager hides the connection/document form fields.
My Apps — Configuration
Overview: app name, App Id (Reference Id), description, status badge, metadata (secret values masked).
Credential tabs
| Tab | Behavior |
|---|---|
| TEST Credentials | API Key / API Secret (masked + show/hide + copy), Status, Created, Revoke, Generate |
| PROD Credentials | Locked + Promote to Prod while Test only; status while pending; live list + PROD API address when Prod active |
Credential metadata (under TEST rows, read-only): Key, Value (secrets always masked), Secret flag, Include in JWT, Include in Token Response, JWT Claim Name.
Secret visibility
| Data | Owner / Developer | Viewer |
|---|---|---|
| API Key | Visible + copy | No secret access |
| API Secret | Masked + eye + copy | Must not see |
| App / credential metadata secret | Masked | — |
| Prod management API key (Manager) | Saved; never shown again | — |
Create Application and Subscription
New application is limited by Portal Settings maxAppCount (default 3).
Name*, description, OAuth2 Redirect URI (https://; may be empty for client-credentials)
One or more products + plan selection
Summary; the app is created with a TEST credential. Use Promote to Prod on the detail for production.
Add subscription: Product & Plan → Confirm → Subscribe. For manually approved plans, the subscription activates after admin approval (Approval Requests). Card actions: Change plan, Unregister.
Subscription card statuses: Active (APPROVED) · Waiting for approval · Rejected · Disabled · Unsubscribed.
Promote to Prod Wizard
Stages: Test → Info & Documents → Approval → Prod active
Required context fields:
- Prod technical contact (email)*
- Expected traffic* (
< 1,000/1,000–10,000/> 10,000req/day) - Static egress IPs*
- Documents (required/optional list from Manager)
Review: test verified + terms & rate limits accepted → Send for approval → Awaiting prod approval → after approval Prod active → credentials on PROD Credentials.
Application Lifecycle
| Status | Meaning |
|---|---|
| ACTIVE | Normal use |
| SUSPENDED | Credentials disabled; subscriptions/analytics kept → Resume |
| PENDING_DELETION | Waiting for deletion approval; keys revoked, traffic stops |
| ARCHIVED | Archived |
Promoted apps (PENDING / PROD) cannot be hard-deleted → Suspend or Request deletion. Hard-delete applies only to Test only apps.
Traffic & Usage (application)
The Traffic & Usage tab on the app detail shows KPIs, quota, charts, and API Traffic in application scope. For platform-wide view see Traffic & Usage.
Usage Scenarios
- A partner integration is finished on Test, then Prod approval is requested with a document pack
- After a security incident, a Prod-active app is Suspended
- Expected traffic gives approvers context before moving to a quota-bearing Prod plan
- Viewer members monitor the app but do not see client secrets