Create and authenticate an application
A Developer Application represents one external product. Register its public identity and RS256 verification keys in CloudPrint, while keeping every private key exclusively in your backend secret store.
Create a Developer Account
Sign in to the Developer Portal with a normal CloudPrint user login and create a Developer Account for the company or team that owns the integration. Membership controls who may manage Applications, keys and installations; it is not a customer CloudPrint Account and it does not own printers.
Register one application per product
Create a Developer Application with a stable name, homepage, privacy-policy URL and exact redirect URIs. The returned client_id identifies the application in installation links and assertion claims. Do not create a separate Application for every customer: each customer connection is represented by an App Installation.
Configure Redirect URIs
The redirect_uri in an installation link must exactly match a registered value, including its scheme, host, port, path and query. Use HTTPS outside local development. HTTP is accepted only for localhost, 127.0.0.1 and [::1]; wildcards, URL fragments and user credentials are rejected.
Register an RS256 public key
Generate an RSA key pair of at least 2048 bits in your controlled environment. Upload only the public key and keep the private key in a managed secret store or HSM. CloudPrint assigns the key identifier used as JWT kid. Use overlapping active keys for planned rotation, then revoke the old key after all workloads use the replacement.
Create a one-time application assertion
Sign a compact JWT with alg=RS256 and the active key ID in kid. Set the Application client_id in iss and sub, use the exact target endpoint as aud, keep exp - iat at five minutes or less and generate a unique jti. Clock synchronization matters. An assertion is single-use and should be created immediately before the request.
Respect application status
Only an active Developer Account, active Application and active key may authenticate. A pending or suspended Application cannot open new installations or issue tokens. A security reset revokes application keys and invalidates the affected access path; surface this state in your operations dashboard rather than retrying indefinitely.
Keep private keys on your servers
Never place the private key or assertion generator in browser code, a mobile application, the CloudPrint Agent or a customer environment. Give signing access only to the service that exchanges credentials, avoid logging compact JWTs and record CloudPrint X-Request-Id together with your internal operation ID for support.
Production checklist
- Use an outbound agent connection; do not expose printer ports to the internet.
- Store the stable printer identity instead of relying only on a display name.
- Validate document format, page size and orientation before creating the job.
- Handle terminal status, retry policy and duplicate-print protection explicitly.