The developer program

The free program for publishing apps that Luma hosts and signs. It is not open yet. What applying will ask for, why Luma verifies identity, what it never stores, and the states an application and a developer account can be in.

The Luma developer program is how developers outside Luma will publish apps that Luma hosts, signs and reviews. It is free.

Why Luma verifies identity

People install apps from Depot because they trust it. That needs someone real and reachable behind each app, so that a security problem reaches a person who can fix it and abuse can be traced and stopped.

Pseudonymous open source developers are welcome. The name people see is the public developer name you choose. Your legal identity is seen only by Luma’s review staff and is never shown on your listing.

What applying asks for

Everyone needs:

A Luma Connect account with a verified email address.
Two-step sign-in turned on, with a passkey or an authenticator app.
A phone number that can receive a text, verified by SMS code. Luma uses it for account recovery and abuse response, and never shows it.
Your legal name, country of residence and a public developer name.
Acceptance of the Depot Review Guidelines and of Luma’s developer terms. The terms aren’t written yet; they will be published here before applications open.
Government ID verification through an identity verification provider.

The legal name the provider verifies must match the name you entered.

Organizations

An organization also gives:

its legal entity name and a registration identifier: a D-U-N-S number, an LEI, or a national company registry number with the registry that issued it;
proof that it controls its domain, either as a DNS TXT record:
```
luma-developer-verification=<token>
```
or as a file at https://<domain>/.well-known/luma-developer.txt containing the token. The portal gives you the token.

The person applying completes the individual ID verification and confirms they are authorized to act for the organization.

What Luma never stores

Identity documents go only to the verification provider. Luma never receives or stores images of your documents or their numbers. It keeps the outcome of the check and the details you entered, and shows reviewers a summary of the evidence.

Application states

draft → submitted → in_review → approved
                              ↘ changes_requested → (resubmit) → in_review
                              ↘ rejected
approved → suspended
approved or suspended → revoked

State	Means
`draft`	You are filling in the application.
`submitted`	Waiting for review, or for identity verification to open.
`in_review`	A reviewer is looking at it.
`changes_requested`	A reviewer needs more information. The reason is shown to you.
`approved`	You can create apps and submit releases.
`rejected`	The application was declined. The reason is shown to you.
`suspended`	Your apps are hidden from new installs and you cannot submit releases.
`revoked`	Your listings are withdrawn.

Every change of state records when it happened and a reason you can see.

Suspension and revocation

Suspension hides your apps from new installs and stops new releases while a problem is resolved. People who installed your apps keep them.
Revocation also withdraws your listings. Installed copies keep working but get no more updates.
A revoked developer may appeal once through the portal.

After you are approved

From Your apps in the portal you will be able to:

create apps and prove their ID namespaces;
edit store pages and your sign-in declaration;
add testers for private releases;
submit releases and follow their checks and review;
see installs and ratings, and reply to reviews.

Apps you publish through the program are in the Verified tier. The Luma tier (“Made for Luma”) is for apps that also meet the Luma tier rules.