I understand that reviewed solutions are able to work with PE and GE organizations. How does this work?

Eligible partners can apply for an API token via the Partner Community. This token is to be used for all API calls for that specific application. Subsequent to the security review and if you’re an eligible partner, we allow API transactions identified with your API token to operate with Professional Edition and Group Edition organizations. See the Use of ClientID page for code examples.