Overview of Certification Requirements

Video: Team Technical Requirements

Planning for and understanding the technical skills your team needs is crucial for building robust app solutions and ensuring a smooth certification process. In this video, we'll explore the key technical requirements that your team needs in order to excel during the HubSpot certification process.

Your team needs to understand the HubSpot platform, which will allow them to plan for and hone the integration and development skills needed during the certification process. When building your app, you can use this lesson to guide your team during the planning phase. If you have an app that's ready to be certified, this guide can also be used as a checklist. During the certification process, plan for any changes that may be requested by the Ecosystem Quality team after the technical audit.

Here are the technical skills you’ll need when building your app and getting it certified:

• Full-stack development skills such as JavaScript, React, and Node.js

• HubSpot development skills, including familiarity with HubSpot’s application programming interface (API) and Command Line Interface (CLI)

• Integration development skills, including familiarity with authentication and API usage

• Database skills, including familiarity with data structures, normalization, and relationships

• And problem-solving skills, including troubleshooting

When scoping out the skills your team needs, you want at least one or two developers that have full-stack development experience. You’ll want to set aside these people as resources for both the building and certification processes. During the technical review, there might be a need for changes to be made to meet all the certification requirements.

This technical person on your team must have an understanding of the HubSpot platform, encompassing its CRM, Marketing, Sales, and Service Hubs. This foundational knowledge is essential for creating app solutions that seamlessly integrate with and enhance the functionalities of these core HubSpot components.

You and your developer should also have a solid understanding of HubSpot development to build apps that integrate with the HubSpot platform. Developers should know how to build custom apps that extend the HubSpot platform. To do this, they should be comfortable with using APIs and CLIs.

Someone on your team should also have experience working in data management and with databases. This skill is crucial for working with HubSpot's CRM and managing data effectively with the platform, especially when creating apps for the HubSpot Marketplace. Understanding database concepts, such as data structures, normalization, and relationships, is essential for developing apps that interact seamlessly with HubSpot's CRM data.

With a solid foundation in data management, app developers can design efficient data storage solutions, ensure data accuracy and consistency, and implement effective data retrieval mechanisms within these apps.

Strong problem-solving skills are essential for navigating the app certification process effectively. Developers need to demonstrate the ability to troubleshoot issues related to HubSpot configurations, integrations, and custom development. You need someone with strong problem-solving skills to efficiently address challenges that may arise during the certification process for your organization’s apps.

To succeed in building apps and getting certified in the HubSpot Marketplace, it's important to have the right technical skills. These skills will help you move through the process smoothly and address any feedback that comes out of the certification process and technical review. And, at the same time, by having these skills from the beginning of the app certification process, you can create high-value solutions that drive business growth and solve for the customer.

Video: Meeting the Security and Privacy Requirements

One of the requirements for the HubSpot Marketplace certification is that your app meets HubSpot's standards. Meeting these standards is essential for building trust with your users and maintaining the integrity of the HubSpot Marketplace ecosystem.

You must meet the following five requirements to get your app certified on the HubSpot Marketplace:

• Your app must be associated with a single HubSpot app ID.

• Your app must authorize API requests with the public HubSpot app ID and OAuth client ID associated with your app listing.

• The OAuth authorization code flow must authenticate your app.

• Your app must make use of all the scopes it requests during the installation process. This includes both the required scope parameters and the optional_scope parameters, when used.

• And your app must be associated with a verified domain.

Once your app meets these requirements, ​​the Ecosystem Quality team will assess your app's public assets to ensure they align with security best practices. Let's break these requirements down.

Your app must be associated with a single HubSpot app ID. Your app can't be associated with multiple HubSpot app accounts. If you have multiple HubSpot app accounts, you’ll need to choose one to associate with the app you’re building. For security reasons, an app is to be associated with a single HubSpot app ID because this unique app ID serves as an identifier. The identifier establishes a secure connection between the app and the HubSpot platform.

Next, your app must authorize API requests with the public HubSpot app ID and the OAuth client ID associated with your app listing. Your app shouldn't be redirected to a different public or private app and mustn't require another public or private app to function. API requests should be authorized with a public HubSpot app ID and OAuth client ID associated with the app listing in order to ensure that only authorized interactions occur.

The app must be authenticated by the OAuth authorization code flow. This authentication method enables secure authorization between a client application, a user, and a server. The OAuth authorization code flow was designed for apps where the client application requires access to protected resources. OAuth authorization code flow is a certification requirement because it’s a secure method for accessing user data without exposing sensitive information, like passwords, or personal data. To meet this requirement, an app can't ask a user to copy and paste OAuth codes or tokens; users should only be asked to grant access. Apps must request, manage, and refresh access tokens without additional user involvement.

Your app must also use all scopes it requests for installation. When you apply for certification, the Ecosystem Quality team will verify if the app uses any additional information. An example of this feedback would be, "Your app currently requires three scopes: timeline, forms, and content. According to our logs, however, it only made requests to Timeline Events APIs in the last 30 days. Since the forms are not required for either of these functions, please remove it as required from the app's settings to minimize the permissions users must accept.” So to clarify, any extraneous scopes must be removed from your app. If you have a subset of your user base using additional scopes, include these scopes as optional using the optional_scope parameter. This requirement ensures that your app only has access to the necessary permissions and resources required for its functionality.

Your app must be associated with a verified domain to establish trust with your customers. This is also a requirement for listing. If you have not yet built your app, this is a requirement that must be met before certification.

Finally, your public assets will be assessed for security best practices, relating to outdated software and various web server vulnerabilities and findings. HubSpot uses a third-party risk management platform to survey an organization’s overall security posture, or cyber-security readiness. During an app certification review, the Ecosystem Quality team leverages reports and recommendations to uncover security vulnerabilities that may affect our mutual customers. This process may include resolving findings resulting from unpatched software, improper restriction of excessive authentication attempts, leaked credentials, and more. Additional reports and findings may be shared during the review to help further reduce the likelihood of ransomware attacks. It's important to note that all identified potential vulnerabilities are found using non-intrusive assessments to scan an organization's cyber risk posture.

By meeting these security and privacy requirements, developers demonstrate their commitment to delivering a high-quality product that adheres to industry best practices. Meeting these requirements enhances the app's credibility and safeguards users against potential risks and vulnerabilities, ultimately leading to a better overall user experience. Prioritizing security and privacy standards is essential to building a strong foundation of trust and integrity within the app ecosystem.

Video: Meeting the Reliability and Performance Requirements

The app certification process is intended to guarantee that your app meets specific reliability and performance requirements. These requirements guarantee that your app runs smoothly and delivers the value customers expect from a certified app on the HubSpot Marketplace. In the following video, we'll discuss the requirements for reliability and performance that an app must meet to become certified.

The reliability and performance requirements are as follows:

• Your app must be in good standing.

• Your app must use stable, public versions of the HubSpot APIs and extensions.

• Your app must maintain a reasonable volume of activity from HubSpot customer accounts.

• Your app must adhere to API usage guidelines and best practices.

• Your app must maintain an average success rate of above 95% across all activities.

​​To be considered in good standing, your app must meet the following criteria.

First, the app must be in compliance with all applicable terms of service. To learn more about these terms, you can find the relevant documentation in the resources section. Your app should have no record of rejection for certification within the last six months. Also, your app shouldn't have unresolved support escalations with shared customers. If a customer has written a review about an issue with your app, you should respond to thank them, acknowledge the feedback, and if applicable, let them know you are working on the reported issue or feature request. Compliance with these conditions is essential to making sure apps on the HubSpot Marketplace have a history of solving customer problems and achieving operational excellence.

Your app must use stable, public versions of the HubSpot APIs and extensions to maintain optimal performance and reliability within the HubSpot ecosystem. Undocumented, beta, or developer preview APIs are considered unstable and subject to change, and therefore shouldn't be used in the production app. This requirement is to maintain consistency and prevent potential issues for customers. If your app is using APIs that aren't stable or public, inform the Ecosystem Quality team during the certification review or the Technology Partner team so that you can discuss your options. These guidelines support the app's performance and ensure compatibility and reliability for users interacting with the app.

Your app must also meet a reasonable volume of customer activity. App activity is defined by OAuth-authenticated requests to HubSpot's APIs and signed requests from HubSpot webhook subscriptions and extensions, for example, CRM card data fetch requests. Another measure of activity is the number of active installs. These are the number of unique HubSpot production accounts, which are unaffiliated with your organization, showing successful app activity within the past 30 days.

Your app must adhere to API usage guidelines and best practices to maintain optimal performance and reliability. Here are a few ways to make sure this happens:

• Respecting rate limits

• Refreshing OAuth access tokens

• Using caching methods

• Using batch APIs and webhook subscriptions

• And using APIs to create properties, workflows, and custom actions instead of requiring users to create them manually

Review the documentation for the API usage guidelines in the resources section of this lesson to learn more about building an app that meets this requirement.

Meeting the API usage guidelines and best practices is especially crucial, so let's break these requirements down further.

Your app should respect rate limits. For example, for search APIs, the limit would be 100 inbound requests every 10 seconds for each HubSpot account that installs the app, or four inbound requests every second per authentication token. This is required to make sure your app has efficient data processing without overwhelming the system. This limitation was put in place to prevent server overload, provide fair resource allocation, and maintain the overall performance and stability of the system. If your app doesn't respect these limits, requests made to your app can throw a 429 error. By following these limits, developers can contribute to a smoother and more reliable experience for ‌app users.

Additionally, timely refreshment of OAuth access tokens before expiration is crucial to maintaining uninterrupted connectivity and data access. OAuth access tokens serve as credentials that allow the app to interact securely with the user's account data, and they expire after 30 minutes. Timely refreshing of these tokens is essential to providing uninterrupted connectivity and continuous access to data within the authorized user account. Review the OAuth Quickstart Guide to set this up in your app.

It's also best practice to cache data for repeat API calls when possible. Caching data means storing and reusing previously fetched data to avoid making redundant requests to the server. By caching data, the app retains a local copy of information retrieved from the server, allowing quicker access to the data without the need to fetch it repeatedly. Caching data is beneficial to enhance performance, and contributes to a more efficient and reliable user experience.

To reduce request volume, use batch APIs and webhook subscriptions. Batch APIs allow for multiple operations to be bundled into a single request. Meanwhile, webhook subscriptions enable real-time notifications to be delivered when specific events occur, reducing the need for frequent polling requests.

Furthermore, using APIs to create properties, workflows, and custom workflow actions spares users from manual intervention and enhances the app's usability and productivity. This approach promotes reliability, efficiency, and streamlined operations during the app configuration and setup processes.

Finally, for API usage, guidelines require that your app maintains an average success rate above 95% across all activities. Requests resulting in error responses count against this success rate. Some unavoidable or expected errors, such as 404s and 409s, may be excluded when calculating success rates across all activities. At this time, the Monitoring tab in your app settings won't calculate and display an aggregate success rate for you. Instead, the Ecosystem Quality team will supply you with the information you need to meet this requirement. However, the Monitoring tab is a valuable tool that can be used to troubleshoot API errors by clicking the individual API calls to view the response body with contains the error message.

The last requirement for reliability and performance is only applicable if your app uses a browser extension. Your app may have a browser extension to deliver supplementary functionality and value to customers. Officially supported UI extensions, such as CRM cards and custom workflow actions, provide more consistent user experiences for customers. Browser extensions shouldn’t be created specifically for the HubSpot UI or as a workaround to HubSpot's APIs. Browser extensions also shouldn’t inject capabilities or components into HubSpot's UI, as the front-end UI of the HubSpot tools is routinely updated, which can break extensions. Note that your app will be subjected to an additional security assessment if it includes a browser extension.

The app certification process is crucial for making sure that apps meet the established standards for reliability and performance. By adhering to these requirements, developers can guarantee that their apps function seamlessly and deliver the expected value to customers on the HubSpot Marketplace. This continuous focus on quality assurance ultimately creates a more reliable and high-performing ecosystem for users.

Video: Meeting the Usability and Accessibility Requirements

Apps listed on the HubSpot Marketplace should aim to earn customers’ trust and solve their problems. One way to accomplish this is by having certified apps with competitive usability and accessibility standards. In this video, we'll explore the usability and accessibility requirements specified by the HubSpot Marketplace for your app, listing page, and supporting documentation.

These requirements specify that one or more people on your team must have technical skills, documentation skills, and content creation skills.

Your app's usability and accessibility will be assessed based on the 10 Usability Heuristics for User Interface Design by Jakob Nielsen.

These heuristics are a set of guidelines or principles that help app creators build interfaces that are easy to use and understand. These heuristics are based on experience and research into what makes a design more user-friendly and efficient. They serve as a kind of checklist to make sure that the design satisfies criteria that contribute to a positive user experience. Overall, usability heuristics help to streamline the design process by providing a framework for creating products that are intuitive, effective, and enjoyable for users to interact with.

To learn more about how to make your app accessible, refer to the 10 Usability Heuristics for User Interface Design chapter asset in this lesson.

Your app’s listing page will also be assessed for usability and accessibility before listing, and again during the certification process. Before you can apply for certification, your app needs to be listed on the HubSpot marketplace for at least six months.

The listing page should describe what the current version of your app does. If functionality changes based on a user's product or subscription level, either for HubSpot or your solution, differences must be made clear. The listing page must communicate accurate pricing information, including a link to your pricing page. If the app supports multiple pricing packages, the HubSpot Marketplace listing must include the least expensive option as a minimum requirement.

The content on your listing page, if it includes images, screenshots, or videos, should be up-to-date. Providing accuracy and clarity in the app listing helps users understand what to expect, make informed decisions based on their needs and budget, and trust that the app meets their expectations. When showing examples for your app, use placeholders or hide personal data by redacting information with a censor bar over text or images to avoid displaying identifiable personal information.

A case study isn't required, but if included, it'll help your app stand out and help your users understand the app better. Only include data or stats on your listing page if a case study is provided as a resource.  For example, hapily, a sales tool used for quote generation, has added a link to a case study on its listing page. The link directs customers to their website, to view a detailed case study.

Be sure to also include a Setup guide URL, which should contain a subdomain and lead directly to the page hosting your app's documentation, not your homepage. This will help guarantee that your users have consistent access to technical set up guidelines.

All other supporting documentation you create must also meet usability and accessibility requirements. The documentation must be live and have a publicly accessible URL. This means that there should be no paywalls or logins that prevent customers from gaining access to this information. Like the listing page, all supporting documentation should be up to date with the app's current version.

The documentation should answer customers' questions, including:

• What does your app do?

• How to install your app and connect a HubSpot account (with screenshots of each step, including the scope approval screen)

• How to disconnect HubSpot from your app

• How to uninstall your app from a HubSpot account

• And how disconnecting and uninstalling might affect users' HubSpot accounts and data

All images in your listing and in your supporting documentation should not only be up to date, but also align with HubSpot’s design system, HubSpot Canvas. The five design principles that guide HubSpot are:

• Clear

• Human

• Inbound

• Integrated

• And collaborative

The Clear principle encourages designing for clarity and focus. Our work helps users do the next right thing through feature prioritization, visual hierarchy, and contextual awareness.

The Human principle means to foster a sense of joy by humanizing the experience in ways that resonate across cultures. Our work provides users with a playful and personable interaction every time.

The Inbound principle means reinforcing the message and meaning of the inbound methodology. Our work makes the inbound path clear to our users and helps them understand why it’s the right thing to do.

The Integrated principle simplifies the user experience by creating a unified system that solves for their needs. Our work helps users achieve great things by offering a streamlined, efficient approach.

The Collaborative principle devises powerful systems that encourage people to work seamlessly together. Our work helps people create and collaborate with each other in natural, intuitive ways.

When your app meets these requirements, your customers can evaluate if it fits their needs, use it easily, and solve their business problems quickly. This will increase adoption, retention, and user satisfaction.