How do I build a partner app for the Monta Applications marketplace?

For: Partners and operators building an integration with Monta.

A partner app is an integration you build yourself against the Monta Partner API, then either keep private to your own operator or publish so other operators can install it. This article covers both paths, from first sandbox call through to general availability.

What is a partner app?

There are two kinds, and the difference decides how operators get access to it.

• Custom app — a private integration scoped to your own operator. It does not appear in the public marketplace, and you can restrict which accounts it reaches.
• Marketplace app — a publicly discoverable integration that any Monta operator can find and install. Operators grant access through OAuth 2.0.

Build a custom app when only your own operator needs the integration. Build a marketplace app when you want other operators to install it.

What do I need before I start?

• Partner API access on your operator. Partner API is a paid feature and may not be available in every account. If you do not see the Partner API option in your Hub, contact your Monta representative.
• A secret manager, or equivalent secure storage, for the app credentials.
• For a marketplace app: a redirect URI served over HTTPS.
• For a marketplace app: a webhook endpoint served over HTTPS that answers with a 2xx status within 10 seconds.

How do I create a custom app?

1. In Monta Hub, go to Developer tools → Applications and select Create app.
2. Select Custom.
3. Enter the app name and category.
4. Select the scopes the app needs. Request the narrowest set that does the job — scopes use the form resource or resource:permission, for example charge-points:read.
5. Optionally restrict which accounts the app can reach.
6. Create the app. Monta shows the client_id and client_secret.
7. Store the client_secret straight away. Monta shows it once and you cannot retrieve it again.

To call the API, exchange the credentials for a bearer token by sending clientId and clientSecret in a POST to https://partner-api.monta.com/api/v1/auth/token.

How do I build and test in the sandbox?

The sandbox gives you the full Partner API surface against synthetic operators and charge points, so you can build the whole integration before touching production.

1. Contact Monta with your app name, the scopes you need, a publicly reachable HTTPS webhook URL, and an address to send credentials to.
2. Monta provisions an install against a synthetic operator and sends an install.created webhook containing install_id, operator_id, client_id, and client_secret.
3. Exchange those credentials at POST /api/v1/auth/token to get an accessToken and a refreshToken.
4. Point your integration at https://partner-api.sandbox.monta.com/api/v1 and build against it.

The sandbox covers every endpoint and scope, the install that represents an operator's grant, the install.created, install.revoked, and install.config.updated webhooks, per-install rate limiting, and the 403 NEEDS_REAUTH response after a scope change.

One thing it does not cover: the OAuth authorization-code handshake. That is certified in production only, so token acquisition is the single part of your integration that differs between the two environments.

Sandbox credentials work in the sandbox only. This sandbox is the Partner API test environment — it is not the same thing as a sandbox sub-account in Monta Hub.

How does an operator connect a marketplace app?

1. The operator finds your app in Monta Hub and selects Connect.
2. Monta builds the authorization request and redirects the operator to the identity provider, where they see the exact list of scopes your app asks for.
3. When the operator approves, Monta creates the install and redirects to your registered callback URI with an authorization code.
4. Your callback handler exchanges that code for tokens using client_secret_post authentication. The code expires after one minute and works once.
5. Call the Partner API at https://partner-api.monta.com/api/v1 with the access token as a bearer token.

Token lifetimes: access tokens last one hour, refresh tokens last 30 days. Refresh tokens rotate, so each refresh invalidates the previous one — always store the newest value, or the whole token chain is revoked.

Redirect URIs are matched as exact strings. Wildcards and extra path suffixes are not accepted.

If you add scopes later, existing installs are not upgraded automatically. Monta flags the affected installs and API calls return 403 NEEDS_REAUTH with a re-authorization URL.

How do I take my app live?

An app moves through four stages.

1. Sandbox — only you can reach the app. You prove the whole integration except the OAuth handshake.
2. Certification — one Monta test operator validates your OAuth flow against production endpoints with synthetic data. This stage checks the handshake and token refresh, since the rest is already proven in the sandbox.
3. Pilot — named design partners run your integration against real charge points and charges. Expect volume, hardware edge cases, and null values the sandbox never produced.
4. Generally available — every Monta operator can discover and install the app, once Monta has reviewed the scopes. Broad permissions such as control-charging get stricter review than read-only access.

Nothing carries over from the sandbox. Production issues a new client_id, client_secret, and webhook_secret; sandbox values fail there with invalid_client. Register your redirect URIs again against the production callback endpoints. Apps, installs, and webhook configuration belong to one environment and are not migrated.

To reach certification, have a production redirect_uri deployed over HTTPS, a webhook endpoint answering 2xx within 10 seconds, and secure storage for the production secrets.

What is available today?

Sandbox access is open, so you can build and test a partner app now. Publishing a partner app to production is not yet available — contact Monta for the current timeline. The rest of the Applications marketplace, including the reporting apps operators connect themselves, is live in production.

Where do I find the developer documentation?

• Custom apps — create a private integration for your own operator.
• Building in the sandbox — provisioning, base URL, and what the sandbox does and does not cover.
• OAuth 2.0 integration guide — the handshake, scopes, and token handling in full.
• Going live — the four stages and the certification checklist.

Related articles

• Find and connect apps in the Applications marketplace — the operator side: browsing and connecting apps.
• How do I access and set up API keys in Monta Hub? — API keys, which are separate from app credentials.