Going to production

Production gives your application access to real citizen and business records from the national digital identity. Before RDCPASS issues production keys, it reviews two dossiers: one about your organization (business due diligence, completed once) and one about each application (application due diligence). Both are submitted from the console and must be approved.

At a glance

• Two dossiers: business (once per organization) and application (once per application, updated on scope changes).
• Submitted by an Owner, Administrator or Compliance officer from the console.
• Typical review: 5–10 business days standard, 10–20 business days with enhanced due diligence.
• Approval unlocks production keys and an mTLS client certificate.
• Obligations continue after launch: annual re-review, incident notification and review of scope changes.

Status lifecycle

Every application moves through the statuses below. Each transition is shown in the console and sent to your webhook as application.production_status_changed.

{
  "id": "evt_1f6b3d9a0c2e7485",
  "object": "event",
  "type": "application.production_status_changed",
  "livemode": true,
  "created_at": "2026-10-08T14:05:12Z",
  "data": {
    "object": {
      "id": "app_5d20e8a1c4",
      "object": "application",
      "production_status": "approved",
      "reviewer_comment": "Business and application dossiers approved. Production keys can be issued."
    },
    "previous_attributes": { "production_status": "in_review" }
  }
}

Business due diligence

Governance checks about your organization. They are completed once and shared by all your applications; RDCPASS re-checks them at the annual re-review.

Application due diligence

Checks about how each application protects the data it receives. Answer them in the application’s Production tab; each item accepts attachments.

Enhanced due diligence

Some services and scopes carry higher risk for citizens. They add the following requirements to the application dossier:

Adding one of these triggers to an application already in production starts an enhanced review of that change. Your existing production access continues during the review.

Required documents

Documents are accepted as PDF in French or English. Documents issued by public authorities must be less than three months old.

Review timelines

The clock runs from submitted and pauses while an application is in changes_requested. Complete, consistent dossiers are the single biggest factor in a fast review.

After approval

# Generate the private key and CSR on your own infrastructure — the
# private key never leaves your servers. Upload only the .csr file.
openssl req -new -newkey rsa:4096 -nodes \
  -keyout rdcpass-client.key \
  -out rdcpass-client.csr \
  -subj "/C=CD/L=Kinshasa/O=Congo Microfinance SA/CN=app_5d20e8a1c4"

Ongoing obligations

Breaching these obligations can lead to suspension of production keys. RDCPASS contacts your Owner and Compliance officer before any suspension, except where citizens’ data is at immediate risk.

Next steps