---
title: Getting approved
description: What ZevID checks before your app can connect to a Zev product, how to request approval, and how to register callbacks and your logo.
---

ZevID approves each **live** app for each product, by hand. Until it does,
the authorize entry sends users back with `unauthorized_client`.

You do not need to wait for it to build. Your test environment needs no
approval: see [Test environments](/delegated-access/testing/).

## Before you ask

1. **Create your live environment.** In the console, use **Go live**.
2. **Verify your domain.** Publish the DNS record shown under **Go live**
   and wait for it to show as verified. Every callback must be on this
   domain or one of its subdomains.
3. **Fill in your consent branding** under **Configuration**: display name,
   app icon, privacy policy URL and terms URL. This is what users see when
   they are asked to approve your app.

## Request approval

Ask ZevAuth support. Include:

- your project name and live environment id (`env_live_…`, shown in the
  console);
- the product, for example `zevcloud`;
- the permissions you need and one sentence on why each is needed;
- any **high-risk** permission you want, with the reason. These are
  approved separately; see [High-risk permissions](/delegated-access/high-risk/);
- your **configure URL**: an https page on your verified domain where a user
  can manage which targets your app uses. ZevID links to it from the user's
  **Apps and websites** page as "Manage teams".

The request is reviewed. Once it is approved, **Delegated access**
appears in your console's sidebar, showing:

- the status for each product: `pending`, `active` or `suspended`;
- the permissions approved for you;
- any permission that is paused, and whether ZevID or the product paused it;
- your callbacks, your connections, and the calls we relayed for you.

Use **Re-read from ZevID** on that page to pick up a change straight away.
Otherwise changes arrive within minutes.

## Register callbacks

Callbacks are registered **per product**, in **Delegated access**, not under
your sign-in callbacks. The two lists are separate on purpose: adding a
sign-in callback never lets a delegated-access flow return there.

| Rule | Why |
| --- | --- |
| `https` only | The `code` is returned on this URL. |
| On your verified domain or a subdomain | A callback elsewhere would let someone else receive the code. |
| Matched exactly | No wildcards or prefixes. `…/cb/../elsewhere` and `yourdomain.com.attacker.test` must never match. |
| No fragments (`#`) or credentials | A fragment never reaches a server. |
| At most 20 per product | |
| Loopback (`http://localhost`) only if it is enabled for your app | For local development against your live approval. Ask ZevAuth support if you need it. |

Saving sends the whole list to ZevID first. If ZevID refuses it, nothing is
saved and its reason is shown next to the field.

## Your logo

ZevID never loads an image from your server. It hosts every logo it shows,
on consent screens and in **Apps and websites**, and each one is reviewed and
approved first.

- **Upload it in the console.** Use the app icon field under
  **Configuration**. We send the file to ZevID. A logo URL you host is never
  used.
- **Requirements:** PNG, JPEG or WebP, at most 1 MB, square (or within
  1.25 : 1), at least 128 × 128 px. SVG is refused.
- **It waits for review.** The status shows under the field:
  *Waiting for ZevID review*, *Approved*, or *Not approved* with ZevID's
  reason. Until a new logo is approved, users keep seeing your previous logo,
  or your app's initial if you had none.
- **A change takes effect once ZevID approves it.** Uploading another file
  replaces one that is still waiting for review.

## Keep your approval healthy

ZevID re-checks your app on every authorize. A suspension, or a lapsed
domain verification, stops **new** connections straight away. Suspension
also stops refreshes. Losing the verified badge alone does not stop
refreshes: existing connections keep working while you restore it.