Going live

AI Passport reviews each sign-in and deep integration before live use. Send a complete packet to support@ego.ist.

What we review

We review these areas:

• The product use case and requested scopes
• Redirect, popup, completion, and sign-out behavior
• Button copy and prominence
• Token storage, rotation, revocation, and incident contacts
• User consent, denial, deletion, and reconnect paths
• Memory attribution, pass handling, and workspace readability
• Connector selection and special-category disclosures
• Quotas, expected volume, retries, and outage behavior

What to send

Send one packet with these items:

1. Legal organization name, product name, website, and primary contact.
2. A short use-case description and the exact scopes you request.
3. Your client_id and every exact redirect URI.
4. Every Passport Link or hosted-key completion URI.
5. Your privacy policy and terms URLs.
6. Screenshots or recordings of each AI Passport entry and return path.
7. A test URL and a test account with no production user data.
8. Your security contact and operational escalation contact.
9. Your refresh-token storage and revoke-on-sign-out design.
10. Your expected daily users, source items, and workspace items.

Deep integration partners shall also send the proposed source slug, connector list, workspace readability posture, and creation-notice posture.

Turnaround

Expect an initial response within 5 business days after we receive a complete packet. Fixes or missing evidence can require another review pass.

The initial response is not launch approval. Launch approval names the admitted redirect hosts, active credentials, quota dials, and launch date.

Client readiness checklist

Before launch, verify each item:

• Treat access_denied as a completed user choice, not a retryable outage.
• Read the returned scope and support narrower grants.
• Send users to approval_url for a missing pass.
• Keep dependency outage distinct from a successful empty result.
• Replace each refresh token pair atomically after rotation.
• Revoke the refresh token when the user signs out.
• Verify state, iss, nonce, signature, audience, and expiry.
• For CIMD, keep every redirect host equal to or below the metadata document host. This host-consistent shape is the rolling self-serve admission path. Send every other client through manual review.
• Enforce strict popup origin checks.
• Use stable ids for every retryable write.
• Tolerate new endpoints, optional fields, errors, and item statuses.

See Brand guidelines for the sign-in control. See the Changelog for additive contract changes.