Skip to main content
Application certification authorizes a specific Flows custom app version for production. The application certification signature is required for production publish in addition to your developer signature. You need both for production. One does not replace the other.
Application certification is required for every Flows custom app published to a production Cognite Data Fusion (CDF) project, even when built by a certified builder. Each app version is certified independently, and every code change (new feature, bug fix, refactor, dependency bump) requires re-certification before you deploy and publish a new version to production.

​
What application certification means

Application certification confirms the app passed defined security, code, and design checks at the time of review. Those checks match the security, data, and UX standards that builders are trained against in builder certification.

​
What it does not mean

  • Certification does not verify that the app is fit for the customer’s specific purpose.
  • Certification does not mean the app is bug-free.

​
When you need it

Request Dev status before you publish to a non-production project. Prerequisites:
  • Active builder certification (valid, not expired).
  • Enterprise license to Cursor, Claude Code, or another agentic coding tool (required to run the certification skills).
  • A Flows custom app created with npx @cognite/cli@latest apps create.
The flow is skill-driven. Each step is a slash command in your agentic coding tool. The skills generate artifacts in your app’s repository, and the final submit skill verifies that every prior artifact exists before packaging the build for submission.

​
How the certification flow works

1

Capture the App Brief

Run /flows-app-brief immediately after creating the app, before you start building.The skill acts as a certification coach: it pre-scans app.json and any spec files for context, then asks targeted questions about your user, the problem the app solves, the one-sentence value statement, and how you’ll measure success. It writes App-Brief.md at the repo root.App-Brief.md is the user-context document reviewers read first. The final submit skill blocks submission until every required field is populated.
2

Build the app

Develop your app using the latest Flows template. Follow the Get started with Flows guide for setup.Pull skills as you go (npx @cognite/cli@latest apps skills pull) so AI coding agents stay aligned with current Cognite best practices.
3

Run the code review

Run /flows-code-review to perform the technical review.The skill produces three artifacts under reviews/code-review/feedback-round-N/:
  • code-review-report.md — scored report covering correctness, SDK usage, dependencies, test coverage, dead code, patterns, Data Modeling Service (DMS) query efficiency, pagination, rate limiting, and Aura usage.
  • review-files.md — per-file inventory.
  • review-packages.md — dependency audit including npm audit results.
The report’s Summary block reports a Must Fix open: count. Re-run the skill (it creates a new feedback-round-N) until the count is 0.
4

Run the design review

Run /flows-design-review to score the app against the 10 design quality questions.The skill is semi-automated: for each question it runs concrete repo probes (grep, lint, build) and proposes a draft 1–5 score. You confirm or override each score after walking your tasks end-to-end in the running app. It writes design-review-report.md under reviews/design-review/feedback-round-N/.Target overall average: 3.8 or higher.
5

Verify and submit

Before running this skill, ensure you have run:
  • npx @cognite/cli@latest apps deploy — builds the app automatically (npm run build) and uploads it, creating the deploy bundle at .cognite-bundles/<externalId>-<versionTag>.zip
  • npx @cognite/cli@latest apps sign — signs the bundle and writes .dev.sig
Ensure your working tree is clean (git status shows nothing uncommitted) before running apps deploy. The build runs automatically and the source archive must match the deployed bundle exactly. See Deploy a Flows custom app for build options.
Run /flows-external-app-submit. The skill verifies five gates before packaging anything:On all-pass, the skill runs npx @cognite/cli@latest apps submit, which collects the source archive (src-<sha>.zip) and the deploy bundle into dist/certification/, then prompts you to add your screen recording to that folder before opening the pre-filled Zendesk form.
6

Submit through Cognite Zendesk

Open the Cognite Zendesk submission form. The form, subject, description, and Cognite Flows product field are pre-filled. Update the placeholders with your app’s details.Place your screen recording in dist/certification/ (the CLI prompts you to do this), then attach all files from that folder:
  • src-<sha>.zip — source archive (committed code only; design-review-report.md is included inside)
  • <externalId>-<versionTag>.zip — deploy bundle; required for signature verification
  • Screen recording of the application walking through the primary tasks (required for the design review)
Submit the ticket. Your submission is reviewed manually.
7

Respond to the review outcome

You’ll receive one of two outcomes from the Zendesk review:
  • Feedback: Address reviewer comments, re-run the relevant skills, commit the updated artifacts, and reply in the same Zendesk ticket with a fresh dist/certification/ folder (new src-<sha>.zip, deploy bundle, and updated screen recording if the UI changed).
  • Approval: Download the .cert.sig from the Yopass link in the ticket. Place it alongside your .dev.sig file, run npx @cognite/cli@latest apps publish, then npx @cognite/cli@latest apps activate.
No committed SLA at launch. Reviews are first-in, first-out as the team scales the process.

​
App tiers

The App Brief asks you to pick a tier so reviewers can calibrate expectations. Pick the closest match; “not sure” is fine, and the reviewer can adjust.

​
Submission requirements

​
Self-check before submitting

Run this checklist immediately before you open the Zendesk ticket:
  • The app is targeting a production project without Dev status (skip certification for Dev status projects).
  • App-Brief.md exists at the repo root and every required field is populated.
  • The latest reviews/code-review/feedback-round-N/code-review-report.md reports Must Fix open: 0.
  • The latest reviews/design-review/feedback-round-N/design-review-report.md reports Average score: of 3.8 or higher.
  • All skill-generated artifacts (App-Brief.md and the latest reviews/ reports) are committed to git (git add + git commit); the submit skill packages only committed files.
  • npx @cognite/cli@latest apps deploy has been run; deploy bundle exists at .cognite-bundles/.
  • npx @cognite/cli@latest apps sign has been run; .dev.sig exists.
  • /flows-external-app-submit ran and printed PASS for every gate.
  • Screen recording of the app’s primary tasks has been placed in dist/certification/.
  • All files in dist/certification/ (src-<sha>.zip, deploy bundle, screen recording) are ready to attach.
If every box is ticked, the submission is ready. Submit through the Cognite Zendesk submission form.

​
Troubleshooting common issues

Open the latest reviews/code-review/feedback-round-N/code-review-report.md and work the Must Fix section top to bottom. Re-run /flows-code-review after each batch of fixes; it creates a new feedback round so reviewers can see your progression. Submission stays blocked until the most recent round reports Must Fix open: 0.
The skill proposes scores from repo probes and your walkthrough notes; you can override any score it gets wrong. Re-run /flows-design-review in a new feedback round, override the scores you disagree with, and add an Improvement note explaining the reasoning so reviewers can follow your thinking.
Any CDF project that does not have Dev status and is used for production decisions, dashboards, or workflows. Typically the project with production (or similar) in the name. If you’re unsure, ask the project’s CDF administrator. When in doubt, certify, or request Dev status for non-production projects.
No. The design review needs to see the app in motion across your primary user tasks. A short walkthrough (2–5 minutes) is enough; narration is optional but helpful.
Yes. Application certification is per-version and applies to every code change (new feature, bug fix, refactor, or dependency bump). Re-run the four skills against the new version and submit a fresh zip referencing the new commit hash before you republish to production.
Yes. Certification is per-commit, not per-change-size. The re-run is fast when nothing meaningful has changed (the code-review and design-review skills produce reports quickly against a known-good codebase), so the friction is small. Production projects only run a certified version, independent of how small the code change is.
Make the fixes, re-run /flows-code-review and /flows-design-review (each in a new feedback round), then re-run /flows-external-app-submit to produce a fresh zip. Open a new Zendesk ticket and note in the description that this is a re-certification, referencing the original ticket number.

​
Further reading

  • Builder certification — Qualify to build Flows custom apps in customer environments before you certify an app version for production.
  • Dev status — Skip application certification on non-production projects.
  • Quality guidelines — The 10 design quality questions the design review skill scores against.
  • Skills — How skills are delivered and refreshed in your app.
  • Get started with Flows — Scaffold a new app.
Last modified on October 27, 2026