Integration Checklist
Step-by-step checklist with owners and lead times.
| # | Step | Owner | Lead time |
|---|---|---|---|
| 1 | Submit the onboarding request — legal entity, domains, brand tokens, contact email | Partner | — |
| 2 | Bluecom issues partnerCode and partnerSecret (1Password share or PGP-encrypted email) | Bluecom | 1 business day |
| 3 | Bluecom provisions your partner record (auth config, reseller, channel, theme class) and adds your domain to the iframe CSP allowlist | Bluecom | 2 business days |
| 4 | Partner implements the Authentication handshake on the backend and the Embedding entry on the frontend/app | Partner | — |
| 5 | Joint smoke test on staging → sign-off → switch to production entry URL | Both | 1 business day |
Total: ~5 business days from request to staging-ready.
Before you go live
partnerSecretlives only on your backend (not in app bundles or repos).- Handshake URL is generated fresh on every Shop open (no caching).
- HTTPS end-to-end.
- Production domain confirmed in Bluecom's CSP allowlist (iframe partners).
event.originvalidation in postMessage listener (iframe partners).- Smoke test sign-off received from Bluecom ops.