Application certification is the quality gate every Flows custom app must clear before it deploys to a customer production environment. It protects the customer, the Cognite Data Fusion (CDF) platform, and the Cognite brand from poorly built apps reaching production, and it enforces the standards builders learn in Builder certification.Documentation Index
Fetch the complete documentation index at: https://docs.cognite.com/llms.txt
Use this file to discover all available pages before exploring further.
When you need it
| You’re deploying to … | Application certification |
|---|---|
| A customer production project, first deploy | Required before deploy |
| A customer production project, any code change (feature, bug fix, refactor, dependency bump) | Required before redeploy |
| A customer dev or test project | Not required (signing may be waived for certified builders on request. Contact your Cognite customer representative.) |
- Active Builder certification (valid, not expired).
- Enterprise license to Cursor, Claude Code, or another agentic coding tool (required to run the certification skills).
- A Flows custom app created with
npx @cognite/cli@latest apps create.
How the certification flow works
Capture the App Brief
Run
/flows-app-brief immediately after creating the app, before you start building.The skill acts as a certification coach: it pre-scans app.json and any spec files for context, then asks targeted questions about your user, the problem the app solves, the one-sentence value statement, and how you’ll measure success. It writes App-Brief.md at the repo root.App-Brief.md is the user-context document reviewers read first. The final submit skill blocks submission until every required field is populated.Build the app
Develop your app using the latest Flows template. Follow the Get started with Flows guide for setup.Pull skills as you go (
npx @cognite/cli@latest apps skills pull) so AI coding agents stay aligned with current Cognite best practices.Run the code review
Run
/flows-code-review to perform the technical review.The skill produces three artifacts under reviews/code-review/feedback-round-N/:code-review-report.md— scored report covering correctness, SDK usage, dependencies, test coverage, dead code, patterns, Data Modeling Service (DMS) query efficiency, pagination, rate limiting, and Aura usage.review-files.md— per-file inventory.review-packages.md— dependency audit includingnpm auditresults.
Summary block reports a Must Fix open: count. Re-run the skill (it creates a new feedback-round-N) until the count is 0.Run the design review
Run
/flows-design-review to score the app against the 10 design quality questions.The skill is semi-automated: for each question it runs concrete repo probes (grep, lint, build) and proposes a draft 1–5 score. You confirm or override each score after walking your tasks end-to-end in the running app. It writes design-review-report.md under reviews/design-review/feedback-round-N/.Target overall average: 3.8 or higher.Verify and submit
Before running this skill, ensure you have run:
On all-pass, the skill runs
npx @cognite/cli@latest apps deploy— builds the app automatically (npm run build) and uploads it, creating the deploy bundle at.cognite-bundles/<externalId>-<versionTag>.zipnpx @cognite/cli@latest apps sign— signs the bundle and writes.dev.sig
/flows-external-app-submit. The skill verifies five gates before packaging anything:| Gate | Required |
|---|---|
App-Brief.md complete (required fields: appName, customer, tier, owner, userRole, currentProblem, oneSentenceStory, successCriteria, userEvidence) | Yes |
Latest code-review-report.md reports Must Fix open: 0 | Yes |
Latest design-review-report.md reports Average score: 3.8 or higher | Yes |
No secrets in tracked files (.env*, .pem, .key, .p12, etc.) | Blocked |
| Working tree clean | Blocked |
npx @cognite/cli@latest apps submit, which collects the source archive (src-<sha>.zip) and the deploy bundle into dist/certification/, then prompts you to add your screen recording to that folder before opening the pre-filled Zendesk form.Submit through Cognite Zendesk
Open the Cognite Zendesk submission form. The form, subject, description, and Cognite Flows product field are pre-filled. Update the placeholders with your app’s details.Place your screen recording in
dist/certification/ (the CLI prompts you to do this), then attach all files from that folder:src-<sha>.zip— source archive (committed code only;design-review-report.mdis included inside)<externalId>-<versionTag>.zip— deploy bundle; required for signature verification- Screen recording of the application walking through the primary tasks (required for the design review)
Respond to the review outcome
For dev / staging projects, the signing requirement may be waived by Cognite on request. Deploy your app, publish it, then activate it.For production projects, you’ll receive one of two outcomes from the Zendesk review:
- Feedback: Address reviewer comments, re-run the relevant skills, commit the updated artifacts, and reply in the same Zendesk ticket with a fresh
dist/certification/folder (newsrc-<sha>.zip, deploy bundle, and updated screen recording if the UI changed). - Approval: Download the
.cert.sigfrom the Yopass link in the ticket. Place it alongside your.dev.sigfile, runnpx @cognite/cli@latest apps publish, thennpx @cognite/cli@latest apps activate.
No committed SLA at launch. Reviews are first-in, first-out as the team scales the process.
App tiers
The App Brief asks you to pick a tier so reviewers can calibrate expectations. Pick the closest match; “not sure” is fine, and the reviewer can adjust.| Tier | Scope | Examples |
|---|---|---|
| Tier 1: Monitoring & reporting | Read-only dashboards, asset/equipment overviews, KPI reports | Asset health dashboard, production KPI overview |
| Tier 2: Operational support | Interactive workflows that support an operator’s day, typically single user group | Work-order triage, data validation, shift handover |
| Tier 3: Business critical | Multi-step workflows, multiple roles, write-back into systems of record | Approval workflows, multi-user collaboration with state changes |
Submission requirements
| Item | Source |
|---|---|
Source archive src-<sha>.zip | dist/certification/ — created by npx @cognite/cli@latest apps submit |
Deploy bundle <externalId>-<versionTag>.zip | dist/certification/ — copied from .cognite-bundles/ by apps submit; must match the signed hash |
| Screen recording of the application | dist/certification/ — placed there by the builder; should cover the primary user tasks named in App-Brief.md |
App-Brief.md (inside src-<sha>.zip) | Generated by /flows-app-brief |
Latest code-review-report.md (inside src-<sha>.zip) | Generated by /flows-code-review |
Latest design-review-report.md (inside src-<sha>.zip) | Generated by /flows-design-review |
Self-check before submitting
Run this checklist immediately before you open the Zendesk ticket:- The app is targeting a customer production project (skip certification for dev or test).
-
App-Brief.mdexists at the repo root and every required field is populated. - The latest
reviews/code-review/feedback-round-N/code-review-report.mdreportsMust Fix open: 0. - The latest
reviews/design-review/feedback-round-N/design-review-report.mdreportsAverage score:of 3.8 or higher. - All skill-generated artifacts (
App-Brief.mdand the latestreviews/reports) are committed to git (git add+git commit); the submit skill packages only committed files. -
npx @cognite/cli@latest apps deployhas been run; deploy bundle exists at.cognite-bundles/. -
npx @cognite/cli@latest apps signhas been run;.dev.sigexists. -
/flows-external-app-submitran and printed PASS for every gate. - Screen recording of the app’s primary tasks has been placed in
dist/certification/. - All files in
dist/certification/(src-<sha>.zip, deploy bundle, screen recording) are ready to attach.
If every box is ticked, the submission is ready. Submit through the Cognite Zendesk submission form.
Troubleshooting common issues
`/flows-external-app-submit` keeps blocking on Must Fix items
`/flows-external-app-submit` keeps blocking on Must Fix items
Open the latest
reviews/code-review/feedback-round-N/code-review-report.md and work the Must Fix section top to bottom. Re-run /flows-code-review after each batch of fixes; it creates a new feedback round so reviewers can see your progression. Submission stays blocked until the most recent round reports Must Fix open: 0.My design average is below 3.8 but my app feels fine
My design average is below 3.8 but my app feels fine
The skill proposes scores from repo probes and your walkthrough notes; you can override any score it gets wrong. Re-run
/flows-design-review in a new feedback round, override the scores you disagree with, and add an Improvement note explaining the reasoning so reviewers can follow your thinking.What counts as a customer production project?
What counts as a customer production project?
Any CDF project the customer uses for production decisions, dashboards, or workflows; typically the project with
production (or similar) in the name and published: true on deployments. If you’re unsure, ask the customer’s CDF administrator. When in doubt, certify.Can I submit without a screen recording?
Can I submit without a screen recording?
No. The design review needs to see the app in motion across your primary user tasks. A short walkthrough (2–5 minutes) is enough; narration is optional but helpful.
The app changed after it passed. Do I need to recertify?
The app changed after it passed. Do I need to recertify?
Yes. Application certification is per-version and applies to every code change (new feature, bug fix, refactor, or dependency bump). Re-run the four skills against the new version and submit a fresh zip referencing the new commit hash before redeploying to the customer’s production project.
Even for a one-line bug fix?
Even for a one-line bug fix?
Yes. Certification is per-commit, not per-change-size. The re-run is fast when nothing meaningful has changed (the code-review and design-review skills produce reports quickly against a known-good codebase), so the friction is small. The guarantee that production only ever runs certified code is what matters.
Reviewers asked for changes. How do I resubmit?
Reviewers asked for changes. How do I resubmit?
Make the fixes, re-run
/flows-code-review and /flows-design-review (each in a new feedback round), then re-run /flows-external-app-submit to produce a fresh zip. Open a new Zendesk ticket and note in the description that this is a re-certification, referencing the original ticket number.Further reading
- Builder certification — Certify yourself before you certify an app.
- Quality guidelines — The 10 design quality questions the design review skill scores against.
- Skills — How skills are delivered and refreshed in your app.
- Get started with Flows — Scaffold a new app.