App Manifest

Define your app's identity, permissions, and configuration in a structured manifest.

Overview

The app manifest is a JSON document that defines your app's identity, required scopes, redirect URIs, and webhook configuration. You can configure the manifest through the developer dashboard or provide it as a JSON file.

Manifest Structure

{
  "name": "My CRM Integration",
  "slug": "my-crm-integration",
  "description": "Sync leads and funded deals with your CRM in real time.",
  "version": "1.0.0",
  "author": {
    "name": "Acme Software",
    "email": "support@acmesoftware.com",
    "url": "https://acmesoftware.com"
  },
  "oauth": {
    "redirectUris": [
      "https://yourapp.com/callback",
      "http://localhost:3000/callback"
    ],
    "scopes": [
      "leads:read",
      "leads:write",
      "funded-deals:read",
      "webhooks:manage",
      "app-data:read",
      "app-data:write"
    ]
  },
  "webhooks": {
    "url": "https://yourapp.com/webhooks/lendworks",
    "events": [
      "lead.created",
      "lead.status_changed",
      "deal.funded"
    ]
  },
  "marketplace": {
    "category": "CRM",
    "pricing": "free",
    "privacyPolicyUrl": "https://acmesoftware.com/privacy",
    "supportUrl": "https://acmesoftware.com/support",
    "websiteUrl": "https://acmesoftware.com"
  }
}

Fields Reference

Root Fields

Field	Type	Required	Description
`name`	string	Yes	Display name shown in OAuth consent and marketplace (3–50 chars)
`slug`	string	Yes	URL-friendly identifier, unique across all apps (3–50 chars, lowercase, hyphens)
`description`	string	Yes	Short description of what the app does (10–200 chars)
`version`	string	Yes	Semantic version of the app (e.g., `1.0.0`)
`author`	object	Yes	Developer or company information

Author

Field	Type	Required	Description
`author.name`	string	Yes	Developer or company name
`author.email`	string	Yes	Support contact email
`author.url`	string	No	Developer or company website

OAuth

Field	Type	Required	Description
`oauth.redirectUris`	string[]	Yes	Allowed redirect URIs for the OAuth callback (at least one required)
`oauth.scopes`	string[]	Yes	Scopes the app requests (see Scopes)

Webhooks

Field	Type	Required	Description
`webhooks.url`	string	No	Default webhook delivery URL
`webhooks.events`	string[]	No	Default event types to subscribe to

If provided, a webhook subscription is automatically created when a user installs your app.

Marketplace

Field	Type	Required	Description
`marketplace.category`	string	Yes	One of: `CRM`, `Analytics`, `Automation`, `Communication`, `Compliance`, `Documents`, `Finance`, `Other`
`marketplace.pricing`	string	Yes	One of: `free`, `free_trial`, `paid`
`marketplace.privacyPolicyUrl`	string	Yes	Link to your privacy policy
`marketplace.supportUrl`	string	Yes	Link to support resources
`marketplace.websiteUrl`	string	No	Link to your product or company website

Validation

The manifest is validated when you create or update an app. Common validation errors:

Error	Cause
`INVALID_SLUG`	Slug contains invalid characters or is already taken
`INVALID_SCOPE`	Requested scope does not exist
`INVALID_REDIRECT_URI`	Redirect URI is not a valid URL or uses HTTP in production (localhost excepted)
`MISSING_REQUIRED_FIELD`	A required field is missing

Updating the Manifest

You can update the manifest at any time while your app is in Draft state. For listed apps:

Non-breaking changes (description, support URL, webhook URL) apply immediately
Scope changes require a new marketplace review
Redirect URI changes apply immediately

See App Lifecycle for details on how updates work at each stage.

App Manifest

On this page