Publishing

A new application is a draft: you and your testers can use it, nobody else. Publishing opens it to everyone (a public bot, a sign-in button anybody can use) and, if you ask, lists it in the App Directory.

The checklist

On the Publish tab the portal shows a live list. Every line has to be done before the button works.

Line	What it needs
Name	A valid name (see Applications).
Summary	A one-line summary.
Description	At least 40 characters saying what the application does.
Icon	An uploaded icon.
Terms of service	A link, on a verified domain.
Privacy policy	A link, on a verified domain.
Redirects	Every redirect address is on a verified domain. http://localhost is for drafts only. A native application's own scheme (com.example.app:/callback) needs no domain.
E-mail	Your Moymo account's e-mail address is verified.
Administrator	If the install asks for the Administrator permission, the review note explains why (at least 20 characters).

"On a verified domain" means the link's host is a domain you have verified or a subdomain of one.

Visibility

Unlisted	Anyone with your link can use it. It is not shown anywhere on Moymo. Published at once.
In the App Directory	Listed for everyone to find. A moderator looks at it first: the application is In review, and works as a draft until it is approved.
Private	Published, but only you and your testers can use it. Published at once.

What changes when you publish

• Anyone can authorise the application. For a bot, anyone can add it to a server they manage if you made the bot public on the Installation tab; if not, only you and your testers can.
• It is no longer limited to 25 servers.
• The consent screen no longer says "draft".
• Keep a separate draft application for development. A published application whose redirect list still has a localhost address no longer passes the checklist, and the portal will say so.

Going back to a draft

Back to a draft on the Publish tab unpublishes the application. People who authorised it keep their tokens until they expire or they revoke them; new people cannot authorise it.

Suspension

A moderator can suspend an application for abuse. Every token of a suspended application stops working at once, nobody can authorise it, and the portal shows you the reason. Contact support to appeal. Examples: a bot used to spam, a leaked token used to attack servers, a consent screen that misled people, an application that breaks Moymo's terms.

Good practice before publishing

• Describe honestly what you ask for and why. The description and summary are on the consent screen.
• Ask for the least you need (Scopes) and the fewest permissions (Permissions). A bot that asks for Administrator will be asked why.
• Have a privacy policy that says what you keep, for how long, and how someone can have it deleted. If you store anything about a member (their id, their username), say so.
• Handle revocation: a member can take back their authorisation at any time; your next call with their token will fail, and your app should treat that as "signed out".
• Rotate secrets when a person who knew them leaves.