A Developer Application represents one external product. Register its public identity and RS256 verification keys in CloudPrint, while keeping every private key exclusively in your backend secret store.
## Create a Developer Account Sign in to the Developer Portal with a normal CloudPrint user login and create a Developer Account for the company or team that owns the integration. Membership controls who may manage Applications, keys and installations; it is not a customer CloudPrint Account and it does not own printers. ## Register one application per product Create a Developer Application with a stable name, homepage, privacy-policy URL and exact redirect URIs. The returned `client_id` identifies the application in installation links and assertion claims. Do not create a separate Application for every customer: each customer connection is represented by an App Installation. ## Configure Redirect URIs The `redirect_uri` in an installation link must exactly match a registered value, including its scheme, host, port, path and query. Use HTTPS outside local development. HTTP is accepted only for `localhost`, `127.0.0.1` and `[::1]`; wildcards, URL fragments and user credentials are rejected. ## Register an RS256 public key Generate an RSA key pair of at least 2048 bits in your controlled environment. Upload only the public key and keep the private key in a managed secret store or HSM. CloudPrint assigns the key identifier used as JWT `kid`. Use overlapping active keys for planned rotation, then revoke the old key after all workloads use the replacement. ## Create a one-time application assertion Sign a compact JWT with `alg=RS256` and the active key ID in `kid`. Set the Application `client_id` in `iss` and `sub`, use the exact target endpoint as `aud`, keep `exp - iat` at five minutes or less and generate a unique `jti`. Clock synchronization matters. An assertion is single-use and should be created immediately before the request. ## Respect application status Only an active Developer Account, active Application and active key may authenticate. A pending or suspended Application cannot open new installations or issue tokens. A security reset revokes application keys and invalidates the affected access path; surface this state in your operations dashboard rather than retrying indefinitely. ## Keep private keys on your servers Never place the private key or assertion generator in browser code, a mobile application, the CloudPrint Agent or a customer environment. Give signing access only to the service that exchanges credentials, avoid logging compact JWTs and record CloudPrint `X-Request-Id` together with your internal operation ID for support. ## Production checklist - Use an outbound agent connection; do not expose printer ports to the internet. - Store the stable printer identity instead of relying only on a display name. - Validate document format, page size and orientation before creating the job. - Handle terminal status, retry policy and duplicate-print protection explicitly. ## Next steps