Delegated access to Zev products
Getting approved
What ZevID checks before your app can connect to a Zev product, how to request approval, and how to register callbacks and your logo.
ZevID approves each live app for each product, by hand. Until it does,
the authorize entry sends users back with unauthorized_client.
You do not need to wait for it to build. Your test environment needs no approval: see Test environments.
Before you ask
- Create your live environment. In the console, use Go live.
- Verify your domain. Publish the DNS record shown under Go live and wait for it to show as verified. Every callback must be on this domain or one of its subdomains.
- Fill in your consent branding under Configuration: display name, app icon, privacy policy URL and terms URL. This is what users see when they are asked to approve your app.
Request approval
Ask ZevAuth support. Include:
- your project name and live environment id (
env_live_…, shown in the console); - the product, for example
zevcloud; - the permissions you need and one sentence on why each is needed;
- any high-risk permission you want, with the reason. These are approved separately; see High-risk permissions;
- your configure URL: an https page on your verified domain where a user can manage which targets your app uses. ZevID links to it from the user’s Apps and websites page as “Manage teams”.
The request is reviewed. Once it is approved, Delegated access appears in your console’s sidebar, showing:
- the status for each product:
pending,activeorsuspended; - the permissions approved for you;
- any permission that is paused, and whether ZevID or the product paused it;
- your callbacks, your connections, and the calls we relayed for you.
Use Re-read from ZevID on that page to pick up a change straight away. Otherwise changes arrive within minutes.
Register callbacks
Callbacks are registered per product, in Delegated access, not under your sign-in callbacks. The two lists are separate on purpose: adding a sign-in callback never lets a delegated-access flow return there.
| Rule | Why |
|---|---|
https only | The code is returned on this URL. |
| On your verified domain or a subdomain | A callback elsewhere would let someone else receive the code. |
| Matched exactly | No wildcards or prefixes. …/cb/../elsewhere and yourdomain.com.attacker.test must never match. |
No fragments (#) or credentials | A fragment never reaches a server. |
| At most 20 per product | |
Loopback (http://localhost) only if it is enabled for your app | For local development against your live approval. Ask ZevAuth support if you need it. |
Saving sends the whole list to ZevID first. If ZevID refuses it, nothing is saved and its reason is shown next to the field.
Your logo
ZevID never loads an image from your server. It hosts every logo it shows, on consent screens and in Apps and websites, and each one is reviewed and approved first.
- Upload it in the console. Use the app icon field under Configuration. We send the file to ZevID. A logo URL you host is never used.
- Requirements: PNG, JPEG or WebP, at most 1 MB, square (or within 1.25 : 1), at least 128 × 128 px. SVG is refused.
- It waits for review. The status shows under the field: Waiting for ZevID review, Approved, or Not approved with ZevID’s reason. Until a new logo is approved, users keep seeing your previous logo, or your app’s initial if you had none.
- A change takes effect once ZevID approves it. Uploading another file replaces one that is still waiting for review.
Keep your approval healthy
ZevID re-checks your app on every authorize. A suspension, or a lapsed domain verification, stops new connections straight away. Suspension also stops refreshes. Losing the verified badge alone does not stop refreshes: existing connections keep working while you restore it.
Updated at, Wednesday, October 21, 2026