Ring Developer Portal — FAQ & Certification Best Practices

Frequently asked questions

Below are answers to questions frequently asked by developers. They are grouped in the following categories:

Account Linking, Authentication & Unlinking

Clarifies that only browser-based OAuth flow is supported (no app-to-app login), provides guidance on nonce matching and unclaimed token pool management, and describes triggering conditions and recommended cleanup actions for account unlinking.

Device Capabilities & Control

Confirms capability fields in the Devices API are currently read-only with no active control functionality.

Motion Detection

Confirms events fire only for motion within configured detection zones.

Private Apps

Covers the differences between public and private apps, the Connect flow, account limits, and subscription requirements for private app users.

Testing & Certification

Explains how to test production endpoints prior to certification, how to ensure smooth certification checks, and why staging users don't purchase your app to test it.

Video encryption (TAKE and E2EE)

Explains what your app can and cannot access on a device the user has encrypted, which encryption mode keeps a device visible to the Ring Partner API, and why no change to your integration is required.

Account linking, authentication & unlinking

Q1. Does the implementation support only browser-based authentication, or is app-to-app login also an option?

Our Ring one-way account linking implementation supports browser-based authentication only. The web-based flow works as follows:

• Ring user discovers your app in Ring App Store and installs it
• Ring user selects the devices to which the app will have access and confirms scopes
• Ring sends OAuth authorization code to the token exchange URL you specified during App Configuration
• Upon receiving the OAuth authorization code in the token exchange URL, you exchange it for access and refresh tokens, and save both along with the Account ID (retrieved from the request to /v1/users/me)
• Ring redirects users to your Account Link URL with query parameters (time and nonce)
• Users must sign in to your partner service through your web interface — this step is mandatory
• After the user successfully signs in, the nonce provided in the redirect is matched against an unclaimed token. Once a match is found the one-way account link is started.

App-to-app login is not supported at this time.

Q2. When querying for unclaimed tokens during nonce matching, should the query include additional parameters beyond status?

No. The query should use only status = 'UNCLAIMED' without additional parameters. This is the documented approach. Your current implementation using the StatusIndex with KeyConditionExpression=Key('status').eq('UNCLAIMED') is correct.

The nonce-to-token matching is designed to iterate through all unclaimed tokens because:

• The nonce cryptographically binds to a specific account_id through HMAC-SHA256(K_hmac, f"{timestamp}:{account_id}")
• Only the correct account_id will produce a matching nonce when computed
• Constant-time comparison is used to prevent timing attacks (reference time provided along with the nonce as query parameters of the forward URL)

Important implementation notes:

• The nonce must be encoded as URL-safe Base64 without padding (A-Z, a-z, 0-9, -, _, no =). Standard Base64 (which uses +, /, and = padding) will produce a different string. In Java: Base64.getUrlEncoder().withoutPadding(), in Python: base64.urlsafe_b64encode(...).rstrip(b'=').
• The time parameter is in milliseconds (Unix epoch), not seconds. Ensure your HMAC payload uses the millisecond value as-is.
• The HMAC signing key is the same key used for webhook signature verification, but webhooks use hex encoding (.hexdigest() + sha256= prefix) while nonces use URL-safe Base64. Do not mix the two.
• Nonce matching must only execute after the user has signed in to your partner service. Ring's certification process verifies that users explicitly authenticate before nonce validation occurs.

Q3. What is the expected load, and how many unclaimed tokens should be maintained in the pool at any given time?

Every nonce matching request will iterate through all unclaimed tokens across all clients. However, the pool should naturally remain small in practice. The system uses a 600-second (10-minute) timestamp validation window, within which tokens should transition from unclaimed to claimed status promptly.

The documentation does not specify an exact number of unclaimed tokens to maintain — pool size depends on your integration's traffic patterns. We recommend the following:

• Implement automatic cleanup of stale unclaimed tokens older than 10 to 15 minutes
• Monitor your unclaimed token pool size actively
• Set up CloudWatch alarms for DynamoDB capacity and throttling

The design assumes tokens are claimed within minutes of creation, keeping the unclaimed pool small at any given time.

Q4. Under what circumstances should we consider an account as unlinked, and what actions should we take?

Unlinking occurs under the following circumstances:

• A user explicitly removes the device from a partner integration
• A user deletes the device from their Ring account
• A user revokes partner access permissions

When you receive a device_removed webhook event, you should take the following actions:

• Immediately clean up resources and terminate any active sessions
• Implement graceful termination of active video streams and scheduled operations
• Archive important data before cleanup for audit purposes

Note: The Ring API will return 404 errors for all requests to devices that have been removed.

---

Testing & certification

Q5. How can I test my production endpoint on account linking prior to app certification?

You can test your production account linking environment by copying your production endpoint URLs into your staging environment configuration and using the test feature. This allows you to verify that your production environment works correctly without needing a separate staging account.

Q6. How do I make sure certification checks go smoothly for my app?

Go through the Best Practices — Before Submission checklist items, as we see certification being rejected due to missing required items from this list.

The Ring certification team uses your production environment account linking to test account linking and functionality of your application. Make sure to test your production endpoint on account linking prior to submitting your app for certification.

In Ring Developer Portal, when submitting for certification, there are fields to add notes for the reviewer. Provide details about how the reviewer should create a new account on your platform, how they should perform account linking step by step, and provide as much detailed information as possible so that certification testing goes smoothly.

Q7. Do staging users have to purchase my app to test it?

No. Staging users authorize your app through the OAuth flow only. There's no purchase or subscription activation step in the staging environment, even when your app is paid. Choose Log in with Ring on the Test page, authorize the app, and the account becomes a staging user that can immediately make API calls and receive webhooks.

This applies to staging only. In production, customers who install a paid app still go through subscription activation as normal, and you still receive the subscription_activated webhook for them.

One requirement remains, and it's a separate thing: each staging user needs an active Ring Protection plan or trial on their own Ring account, because that plan activates the cloud features on the Ring devices you test against. It isn't a charge for your app.

For the full walkthrough, see Test Your Ring App Store Integration. For the announcement, see the September 10, 2026 release notes.

---

Device capabilities & control

Q8. The Devices API returns capabilities such as zoom track and IR control. Does this indicate that future integration phases will support device control functionality beyond live streaming?

At this time, device capability values returned in the Devices API are read-only. They do not indicate active control functionality. If you have specific ideas or requirements around device control, we encourage you to share them — partner input directly informs our roadmap.

---

Video encryption (TAKE and E2EE)

Q9. How do TAKE and E2EE work?

Ring is rolling out two video-encryption modes: Throw Away the Key (TAKE) and End-to-End Encryption (E2EE). For details on how each mode works, see Ring's public overview: https://www.aboutamazon.com/news/devices/ring-take-encryption

Q10. Will my app work for a user on TAKE, and when?

Not during the initial rollout. A TAKE device is visible and callable via the Ring Partner API, but video requests return encrypted content, so your app cannot read recordings or snapshots, or open a live stream. We are working to enable partner apps to process the most recent 24 hours of a TAKE device's video and live stream from it. Once that capability ships, TAKE devices will be connectable again. We will announce it in this FAQ.

Q11. Will my app work for a user who enables E2EE?

No. E2EE devices are not returned by any Ring Partner API, as users can't grant partner apps access to E2EE devices. Only the user's own enrolled devices can decrypt that video; Ring cannot grant Ring Appstore partner apps access to it. E2EE is set per camera or doorbell, so a user may have it on some cameras and not others.

Q12. What happens to a device already connected to my app if the user encrypts it?

It stays connected, and encryption does not cancel the user's app subscription. For a TAKE device, video requests continue to succeed but return encrypted content until Ring Appstore support for TAKE becomes available. An E2EE device drops out of your app's view entirely.

Q13. Do I need to change my API integration?

No. Endpoint paths, request parameters, request bodies, response schemas, status codes, authentication, account linking, consent flow, and webhook signature verification are all unchanged. We will expose encryption status through our API soon so your app can detect it and respond accordingly. Playback capability stays the same, but video from a TAKE device is encrypted and unreadable by your app. We are also working to enable partner apps to process the most recent 24 hours of a TAKE device's video and live stream from it. Once ready, TAKE devices will become connectable again. We will announce the capability here once it is ready.

---

Motion detection

Q14. Are motion events sent whenever motion is detected within a specified detection zone, or are they sent regardless of whether the motion falls within the zone?

Motion events are sent only when motion is detected within the specified zone. Detection zones are defined with normalized coordinates (0.0 to 1.0 range), with a UUID id and vertices arrays. The detection zone configuration affects how the device processes motion at the hardware level, so events will not fire for motion outside the configured zone.

---

Private apps

Q15. What is the difference between a public app and a private app?

Public apps go through the full lifecycle (Configure → Build → Test → Certify → Publish) and are published to the Ring Appstore for all customers. Private apps follow a simplified lifecycle (Configure → Build → Connect) and are visible in the Ring Appstore only to the Ring accounts you explicitly authorize (up to 10).

Private apps also get no weekly metrics reports — the Reports page is available for public apps that are live in production.

Use private apps for:

• Personal integrations and home automation projects
• Internal tools for a single organization
• Development and testing before building a public app
• Proof-of-concept applications

Q16. How do I connect Ring accounts to my private app?

After completing the Configure and Build phases, the Connect step becomes available in your app's overview page. The Connect flow works as follows:

1. Ensure your Account Linking configuration is complete (Account Link URL and Token Exchange URL are required)
2. Navigate to the Connect section in your app overview
3. Choose Log in with Ring to start the authorization flow
4. Authenticate with a Ring account and authorize the app to access Ring devices
5. The account appears in your connected accounts list

You can connect up to 10 Ring accounts to a single private app. Each connected account must have an active Ring subscription or a Ring trial (about 30 days) to enable device access.

The Connect step uses the same OAuth account linking flow as public apps — Ring sends an authorization code to your Token Exchange URL, you exchange it for tokens, and the user completes account linking at your Account Link URL.

Q17. Can I disconnect accounts from my private app?

Yes. The Connect section provides a Disconnect all option that removes all connected Ring accounts from your private app. After disconnecting, tokens for those accounts are invalidated and webhook events stop.

Individual account disconnection is not currently supported through the Developer Portal. Users can also disconnect from their side through the Ring app.

Q18. Do private apps need a Ring subscription?

Yes. Each connected account needs either a paid Ring sugit statusbscription or an active Ring trial (about 30 days) to access Ring devices through your private app.

Q19. Are private apps subject to geographic restrictions?

Partly. Private apps bypass the state-level distribution restrictions that public apps configure during the Publish phase, so any connected account can access the app from anywhere in the US regardless of state. The Ring Appstore itself is reachable only from US locations — see Q21.

Q20. Can I convert a private app to a public app?

Not directly. If you want to publish your integration to all Ring customers, create a new public app and complete the full certification process. You can reuse the same backend implementation — the Ring APIs work identically for both app types.

---

App Store

Q21. When I try to access Ring Appstore I am redirected to the Ring top page instead

Currently, the Ring Appstore is only reachable from locations within the US. Users outside of the US are forwarded to the Ring top page.

---

Certification best practices

Before submission

1. Verify Configuration Details
   • App name is accurate and professional
   • Description clearly explains app functionality
   • Tags accurately represent your app's category
   • Features list is correct (e.g., Liveview)
   • OAuth scopes match your requirements (e.g., ava.devices)
   • App logo is high quality (PNG, 512x512px recommended)
2. Test All Configured Endpoints
   • partnerConfigUrl is accessible and returns valid JSON
   • partnerLinkUrl handles account linking requests
   • redirectUrl matches your OAuth implementation exactly
   • webhookUrl accepts POST requests and returns HTTP 200
   • All URLs use HTTPS (required for production)
   • Endpoints are deployed to production environment
3. Validate OAuth Implementation
   • OAuth flow works end-to-end with configured endpoints
   • Authorization requests are handled correctly
   • Token exchange works properly
   • Redirect URL matches configuration exactly (including trailing slash)
4. Test Webhook Endpoint
   • Endpoint accepts POST requests with JSON payload
   • Returns HTTP 200 within 5 seconds
   • Handles Ring's webhook payload format
   • Signature verification implemented (if required)

During review

1. Monitor Status: Check the portal regularly for certification updates
2. Keep Endpoints Stable: Don't modify or take down configured endpoints during review
3. Monitor Endpoint Logs: Watch for Ring Team testing your endpoints
4. Respond Quickly: Address any questions or feedback from Ring Team promptly
5. Be Available: Ensure your team can respond to configuration issues

After submission

1. Don't Change Configuration: Avoid modifying endpoint URLs during active review
2. Maintain Endpoint Availability: Keep all configured endpoints operational and responsive
3. Monitor for Test Traffic: Ring Team will test your endpoints - ensure they respond correctly
4. Prepare for Feedback: Be ready to update configuration if issues are found
5. Plan Next Steps: Prepare for the Publish phase once certification passes

---

Related topics

• Certify Your Ring Application — Certification process and submission guide
• Ring Partner API Documentation — Complete API reference and integration guide
• Configure Your Ring Application — App registration, credentials, and endpoint setup