Multi-tenant CRM integration

First of all, for app access type, you can decide:

• A public app registered to RingCentral by you if you have a RingCentral account: For any customer who uses the CRM integration, you authenticate the user using your public app client Id/secret.
• A private app registered to RingCentral by a customer who has a RingCentral account: You provide the instructions with all the app requirements (access type = private, platform type, grant type and app scopes as your existing app). For any customer who uses the CRM integration, they have to use your your instructions to register their own private app and provide you with their app client Id/secret (maybe they can put the app credentials into the CRM configuration page)

The rest is up to you, how you want users to login and use the integration.

• If a user signs in to operate on the entire account, for example to read and process the account or any user call log, message store etc., then you would require a user with the super admin role to login. You can let the user sign in once and keep the access token and the refresh token until the user deliberately signs out.
• If each individual user signs in to operate on their own activities such as making a call, sending a SMS message etc. Then each user signs in themselves. You can let the user sign in once and keep the access token and the refresh token until the user deliberately signs out.

The VoipCalling app scope requires approval. Just select it for the app, the system will trigger a support case and the dev support team will process the request to approve or reject.

Thanks — this clarifies the access model and confirms that VoipCalling requires approval. A few follow-ups:
Public app: Can we use one Public app/client ID for our CRM and have users from multiple independent RingCentral customer accounts authorize that same app with their own RingCentral credentials?
Per-user WebPhone: Once an individual user authorizes the Public app, can we use that user's OAuth token to provision and operate their browser WebPhone via sip-provision/WebPhone SDK, including inbound and outbound calling?
VoipCalling approval: We currently don't see VoipCalling available in our Developer Console. Should we simply add/select the VoipCalling scope and let that automatically create the support case, or is there anything we need to submit separately for approval?
Testing: Since we have our own RingCentral account, can we request/enable VoipCalling on our existing test application/account first, validate the WebPhone integration there, and then use the same Public app for other customer accounts once approved?

This is very helpful! Before enabling VoipCalling, we want to confirm the recommended production and testing architecture.
1. Abuse/enforcement isolation: If one customer or user using our Public application violates RingCentral calling policies, can RingCentral suspend/block only that customer, user, extension, or account, or can the entire application/client ID be suspended and therefore disable calling for every unrelated customer using our integration?
2. Test vs. production: Do you recommend using a separate Public application/client ID for development/testing and a different Public application/client ID for production customers? We want our test activity and development mistakes isolated from production customers.
3. Multi-tenant architecture: For a SaaS application serving many independent RingCentral customer accounts, is the recommended architecture one Public application shared by all customer accounts, with each user authorizing individually, or should we use separate applications/client IDs per customer or tenant for isolation?
4. VoipCalling approval: For the test application, is selecting VoipCalling and submitting the scope change sufficient to trigger the required support review? Once approved, can we fully validate WebPhone inbound/outbound calling on our own RingCentral account before enabling the production application for customer accounts?
We want to make sure we establish the correct isolation model before putting unrelated customer accounts behind the same application/client ID.

Thanks for your help in advance! 

1. VoipCalling on the existing Public app

We have an existing Public REST API application for a multi-tenant CRM. The app currently works with our existing scopes, but VoipCalling is not available in the Developer Console and requesting it at the authorize endpoint returns invalid_request — Parameter [scope] value is invalid.

We understand from prior guidance that VoipCalling requires a support ticket to be enabled.

Can RingCentral enable VoipCalling on this existing Public application, or does enabling it require registering a new application?

2. Development vs. production

You recommend maintaining separate applications for testing/development and production. For our multi-tenant integration, should we therefore have:

• one Public app/client ID for development/testing, and
• a separate Public app/client ID for production,

with VoipCalling enabled on each independently?

Is there any reason the production application would need to be recreated rather than using our existing Public production application once VoipCalling is approved?

3. Scope addition / existing authorizations

When RingCentral enables VoipCalling on an existing Public application, what happens to existing OAuth grants and refresh tokens for that application?

Specifically:

• Are existing users/tenants automatically unaffected?
• Do they need to re-authorize because the application's scope set changed?
• If re-authorization is required, does it affect all existing grants or only users who subsequently request the new VoipCalling scope?

1/ New scope will be added to the existing app.

2/ Each app registration requires a separate approval for sensitive app scope. You can use the same app for both development and production if you want to. It’s about your developing/test code vs. your production code and you should run them on different processes. The benefit of having a different app for development is for testing new features that require new app scope(s), or remove a feature that no longer requires a scope. Or heavy tests that often hit the API rate limit etc.

3/ When submit the changes to the app settings, the system will prompt you to decide if currently authenticated users need to re-authenticate or not.

I’m trying to test a multi-tenant RingCentral integration. I already have one production account connected and working. I need a second, separate RingCentral account to test that two different tenants can connect to the same app while staying isolated.

Is the current RingCentral Development Environment suitable for this? If so, can it provide an account/extension with WebPhone, VoIP Calling, and a Digital Line so I can make an actual test call?

I’m just trying to understand the current recommended way to do this.