Preparing the API
The API must use HTTPS, revocable authentication, rate limiting and versioned responses. Administrative keys are not included in the mobile application.
Setup
Defines environments, API URLs, deep links, application identifiers and notification providers. Sensitive data is kept in the secure storage of the operating system.
Testing
Test login, token expiration, offline mode, slow connection, notifications and minimum iOS/Android versions. Validation includes real devices, not just the emulator.
Publication
Production builds are signed with client certificates. Release notes, privacy policy and App Store/Google Play accounts must be prepared before the review.