Partner platform planning guide.

No partner endpoint, credential, sandbox or installable listing is available through this preview. Existing CarSoft software and native apps are separate from this planned partner platform.

Receipt of an application will not grant approval or credentials. Developer portal hosting remains undecided. Local platform-admin review now requires exact redirect, webhook and embedded host DNS TXT proof before app approval, credentials or installation. Publish the administrator-issued random value at _carsoft-partner.<hostname>; one-hour rotated challenges cannot be reused. Proof lasts 30 days and does not cover subdomains or other organizations. Expiry/withdrawal gates live access; after reproof, obtain fresh dealership OAuth. Local credential routes implement MFA-protected listing/create/rotate/revoke with exact reviewed redirects/domains, credential-version concurrency and one-time secrets. Identical UUID issuance retries return original-client metadata with secretUnavailable, not another secret or client. Role/status changes retire current-secret-held clients and conservatively retire untracked legacy clients for technical-member changes. Other current holders and concurrent owner custody transfers are preserved; authorization-only epoch changes retain unchanged-secret custody. Replacement requires fresh dealership OAuth and never expands consent. Local credential sharing requires a current owner/admin secret holder, separate recent-MFA recipient acceptance and manual platform review of live identities, custody purpose and private evidence. Seven-day requests bind current client version, member epochs and exact fingerprints; one pending per client/recipient and 50 per organization. No raw secret is accepted, recovered or delivered. Share through a secure external channel only after approval. Offboarding any current holder retires the shared client. Approval creates no OAuth or dealership grant. Hosted portal, sandbox, full financial/billing and provider lifecycle acceptance remain incomplete. Local developer routes use a separate provider JWT, verified email/TOTP MFA, active organization role and recent MFA for mutations. Local organization invitations let owners invite admins/developers/billing/support and admins invite developers/billing/support. They cannot create owners or claim platform review; platform bootstrap invitations remain separate. Tokens are shown once and only hashes stored. Exact retries return original metadata without exposing or replacing tokens. Acceptance checks live issuer identity, role and epoch; offboarding retires pending invitations. No email is sent automatically. Hosted team portal, provider enrollment/recovery/lifecycle, sandboxes, payments, billing and full launch acceptance remain unfinished. Platform-reviewed bootstrap invitations grant organization access only; immutable update candidates require separate platform review and dealership revision consent. Local app registration requires an active owner/admin/developer and recent TOTP MFA. A UUID request receipt recovers the original unpublished app; changed reuse conflicts and organizations are limited to 100 apps. Initial submissions require explicit baseRevisionId: null, manual exact-candidate review, domain proof and evidence. Atomic first revision approval creates no credentials or installations. Local owner-role transfers require a current owner, independent incoming-member MFA consent and manual platform review with live provider identity/email/MFA checks and private evidence. Seven-day expiry, member epochs and immutable fingerprints bind the decision. Approval revokes outgoing membership and retires affected credentials while preserving other known holders and dealership consent. No credentials, installations or funds are created. Hosted provider lifecycle/recovery, sandboxes, payments, billing and full launch acceptance remain unfinished. Local organization domain controls offer exact-host one-hour TXT challenges, versioned verification/revocation and 30-day proofs under current owner/admin recent TOTP authority. Domain proof approves no app or dealership access. The gated local portal now includes team invitation, ownership and credential-sharing controls; incoming acceptance still requires separate platform review. Hosted email/CAPTCHA, reviewed lost-factor recovery, merchant onboarding/full API-to-ledger, finance adjustments/contact replacement, usable isolated sandbox and full launch remain unfinished. Authenticator replacement is still under implementation and has no accepted-readiness claim. Portal and Website intake remain gated.

Fixed app permissions require platform approval and dealership consent. Background and user-initiated actions remain bounded by that grant. Destructive deletion, staff/role management, platform administration and cross-dealership grants are excluded. Declared scopes and field schemas appear in the local versioned Software draft contracts; they are not released production interfaces.

Sensitive financial/staff data, payment secrets, identity documents, login credentials and internal notes are excluded from the general partner API. Disconnection stops new access, jobs and deliveries; partner-held data must be deleted within 30 days, subject to disclosed approved retention exceptions. Already-submitted payments still require internal reconciliation.

The future exclusive provider will be different from Stripe; selecting and integrating it is separate work and does not block marketplace completion. General external payment-provider onboarding and multi-provider support are outside the current scope. No exclusive agreement or different integration is claimed. Merchant ownership, direct dealership settlement, protected credentials, customer consent, charge/refund limits, idempotency and verified receipts remain required. Account or credential changes must preserve original transactions. CarSoft partner-fee billing separately continues through its current Stripe account. Planned capabilities include payment links, status, saved-method charges and refunds with separate permissions. Charges require customer authorization. Refund limits must be cumulative and configured by dealership admins; above-limit requests require confirmation. Draft invoice edits are allowed by policy, but financial details lock once payment begins. Customer funds go directly to dealership merchant processor accounts. Local Software now includes customer invoice and payment-intent/cancellation contracts. Provider sandbox acceptance, customer setup and complete financial adjustment/dispute flows remain incomplete; these are not released production capabilities.

Other embedded extension locations and complete replay/recovery controls remain pending; no released readiness is claimed. No partner scripts should be injected into the host. Native compatibility requires separate Mobile App verification.

CarSoft separately bills partners approved platform charges; no CarSoft partner payout/distribution service is planned. William approves app pricing and changes. Partners support their apps; CarSoft supports the platform and may suspend apps. Exact charges and service targets are not published. Local billing agreements contain individually reviewed immutable monthly terms. Only current organization owners with recent TOTP MFA can accept or decline exact fingerprints. Offers expire after 14 days; one accepted agreement per UTC calendar month, with subsequent prices effective on a future month’s first day. Accepted terms cannot be rewritten. Acceptance creates no invoice, charge or API access. CarSoft fees will use its current Stripe account; partners collect their own fees. Overdue invoices require William’s manual decision. Local billing periods provide read-only owner/admin/billing access with provider/TOTP identity. Immutable completed UTC-month records bind exact terms, usage and calculations; monetary totals are exact strings. Only successful production app API requests count; OAuth/developer calls, failures and sandbox requests are excluded. Installation-day evidence begins with the ledger, without invented history. Revenue statements require the exact commercial window and currency; versioned corrections precede freezing and separately reviewed adjustments follow. Local Stripe issuance/reconciliation and reviewed customer setup have isolated protocol tests. Invoice workers and the durable overdue email queue are locally verified; credits/refunds/disputes and merchant adapter acceptance remain incomplete; voluntary cancellation, monthly scheduling and signed billing reconciliation are locally verified but not activated. Production billing is not activated. Local billing-account reads provide safe owner/admin/billing status and consent history. Only a current owner with recent TOTP MFA can consent to invoices at their provider-verified email; the server captures email and reviewed organization name. Exact UUID receipts, seven-day expiry and current owner/email/epoch checks bind manual platform review. Customer setup is separate and requires activation, a dedicated CarSoft partner customer and stable idempotency. It creates no invoice, payment method, charge or API access and never reuses dealership subscription customers. Local invoice history exposes exact monetary strings and safe last-confirmed provider status, excluding provider identifiers and private evidence. Review-required amounts may be stale and are not fresh payment evidence. Invoice workers, manual overdue decisions and a durable existing-admin-address email queue are locally verified; email provider acceptance does not prove inbox delivery. Automatic completed-month scheduling, reviewed admin pause/resume and tax mappings are locally verified. Signed native Stripe events use bounded raw signature input and persisted provider invoice ownership, then fetch current payment state. Duplicate/out-of-order events and lease recovery cannot create or send invoices through reconciliation. Voluntary cancellation requires the current organization owner, exact agreement fingerprint and recent TOTP MFA. Agreed period-end or immediate-prorated cutoff governs access and final fees; existing payments reconcile and owed invoices remain payable. Active owner/admin/billing members retain billing history access. Cleanup preserves the original cutoff plus 30-day deletion deadline. Four actual Stripe sandbox partner-fee scenarios passed with synthetic customers; email delivery and production activation remain separate unfinished acceptance requirements. Installed merchant-adapter SDK tests also passed wrong-account/mode/customer refusal, a saved-method charge fully refunded with a bound refund, and a stable hosted link subsequently expired. Full hosted merchant/customer onboarding, API-to-native-ledger acceptance, completed hosted checkout, selected-provider production acceptance remains unfinished. Overdue billing never automatically suspends or cancels a partner. Local platform-admin sensitive reviews require the current password and a verified authenticator session. Reviewed versioned tax replacements preserve prior rates on queued invoices and accepted pricing. Email retry uses the same immutable message/key within 23 hours; older uncertain outcomes require a verified read-only provider receipt, never invented delivery. Software release and live notification acceptance remain outstanding. Credits/refunds/disputes and hosted developer portal remain unfinished. Hosted scheduling activation, deployment capacity and release approval are outstanding; no production activation is claimed. No automatic suspension, Connect or fund distribution.

Software locally implements platform-admin revision consent and credential rotation/revocation, including invalidation of prior OAuth sessions. Local bounded synchronous export/bulk jobs now have contracts, private authenticated JSONL downloads and cancellation. Bulk requires separately approved resource:bulk scopes in addition to ordinary action permissions. Local inventory marketing-gallery reads require separate media:read and inventory:read approval/consent. Private authenticated JPEG downloads enforce tenant/vehicle/photo binding, raster re-encoding, metadata removal, permission rechecks and bounded resource use. Media upload/replacement, other attachments, protected real-storage acceptance, large queued jobs, developer onboarding and full launch readiness remain incomplete. Software owns versioned OpenAPI, events, manifests, bridge and processor schemas. Website documentation and downloads must consume matching reviewed release artifacts. No endpoints, scope identifiers, quotas or support periods are invented in this guide.