App Lifecycle

This guide covers the full lifecycle of a stemp application — from creation to publishing on the marketplace.

Overview

Every stemp app goes through these stages:

Create App → Configure OAuth & Scopes → Create Version → Submit for Review → Approved → Publish

Creating an App

1. Log in to the Developer Portal.
2. Click Create Application.
3. Provide the required details:

After creation, you'll receive a Client ID. Your Client Secret can be revealed once from the OAuth settings page.

Configuring Your App

OAuth Settings

Navigate to the OAuth tab in your app settings to manage:

• Client ID — Your app's public identifier.
• Client Secret — Used for server-side token exchange. Keep this secret. You can rotate it at any time.
• Redirect URIs — Allowlisted callback URLs for the OAuth flow.

Scopes

On the Scopes tab, select the permissions your app requires. Follow the principle of least privilege — only request scopes your app actually needs. See the Scopes reference for all available permissions.

Webhooks

On the Webhook tab, configure an HTTPS endpoint to receive real-time event notifications. See Webhooks for setup details.

App Listing

On the main Listing tab, configure how your app appears in the marketplace:

• Logo — Square image representing your app.
• Cover Image — Banner image for the marketplace listing.
• Screenshots — Up to 5 screenshots showcasing your app.
• Description & Long Description — Shown on your marketplace listing.
• Links — Website URL, support URL, privacy policy, and terms of service.

Version Management

stemp uses a versioning system to control what gets published to the marketplace. Each version is a snapshot of your app's configuration.

Creating a Version

1. Navigate to the Versions tab.
2. Click Create Version.
3. The version captures your current app configuration (name, description, scopes, listing details).

Version States

Submitting for Review

Once your version is ready:

1. Click Submit for Review on the version.
2. The stemp team reviews your app for quality, security, and policy compliance.
3. You'll be notified when the review is complete.

Publishing

After approval:

1. Click Publish on the approved version.
2. Your app becomes live on the stemp marketplace.
3. Organizations can now discover and install your app.

App Installation Flow

When an organization installs your app:

1. A user clicks your Install URL or finds your app in the marketplace.
2. They are shown a consent screen listing the scopes your app requests.
3. After granting consent, they are redirected to your Redirect URI with an authorization code.
4. Your server exchanges the code for access and refresh tokens via the OAuth2 flow.

Tracking Installations

On the Installations tab, you can see:

• Which organizations have installed your app.
• What scopes were granted to each installation.
• When the app was installed and last used.

Managing Secrets

Rotating the Client Secret

If your client secret is compromised:

1. Go to the OAuth tab.
2. Click Rotate Secret.
3. Update your server configuration with the new secret.
4. The old secret is immediately invalidated.

Webhook Signing Secret

Similarly, you can rotate the webhook signing secret from the Webhook tab. Update your webhook verification logic after rotation.

Deleting an App

Deleting an app is permanent and:

• Revokes all active installations.
• Invalidates all access and refresh tokens.
• Removes the app from the marketplace.

Navigate to app settings and click Delete Application.