Listing a SaaS Product on the HubSpot App Marketplace: What It Actually Takes

If you sell software and your customers run HubSpot, a public App Marketplace listing looks like an obvious growth channel. Get discovered, get installed, ride HubSpot's distribution. The instinct is right. The effort is almost always underestimated. Most vendors treat a listing as a one-off integration project, ship it, and move on. The reality is closer to launching a small SaaS product of its own, with a security posture, a customer base and a compliance lifecycle that never really ends.

This article is for a software vendor weighing it up. It covers what a public listing actually requires, where the certification bar sits, and why the ongoing commitment is the part that catches teams out. It is a readiness check, not a step-by-step build guide.

Listing and certification are two different bars

The single most common misunderstanding is treating "listed" and "certified" as the same thing. They are not. An app can be listed without being certified, and certification is the trust badge that genuinely drives discovery and installs. It sits on top of months of live, real-world usage, so you cannot shortcut to it.

Getting listed is the entry bar. Getting certified is the quality and trust bar. Both matter, and understanding the gap between them is the first sign of a vendor who has done their homework.

What it takes to get a public app listed

To list a public app on the Marketplace, HubSpot's current requirements are firm on a few non-negotiables:

• OAuth only. The app must be a public OAuth app, and OAuth must be its sole authorisation method. Pasted API keys or "enter your token" auth are prohibited. You must use the authorisation code flow and refresh tokens automatically, with no user involvement.
• The app must be unique. Apps with similar functionality hitting the same APIs have to be consolidated into one. A listing cannot redirect to another app or depend on a second app to function.
• Active installs before you submit. HubSpot requires a minimum number of active, unique installs (currently three) in unaffiliated production accounts showing real activity in the past 30 days before you can even submit the listing. HubSpot has revised these thresholds before, so treat the exact figure as a moving target.
• An install cap until you are listed. Apps on the current developer platform version are capped at 25 installs until the app is listed. If you only need a handful of customers, private distribution via OAuth (up to 10 customers, or 100 for Solution Partners) may suit you better than a public listing at all.
• Real listing content. You need an integration-specific description (not generic product marketing), live public URLs for setup docs, support, Terms of Service and a Privacy Policy, a Shared Data table accurately mapping which CRM objects you read and write, pricing that matches your own website, an install button and a support contact.
• Minimal scopes. Request only the OAuth scopes you actually use. Extraneous scopes are a documented rejection reason.

Submissions are manually reviewed by HubSpot's Ecosystem Quality team. Initial review lands within about ten business days, and the full process can run up to roughly 60 days from feedback in a typical case. Only one app can be in submission at a time. As of 31 March 2026, you no longer hand over test login credentials; instead you provide demo videos and guided walkthroughs showing your core user flows, configuration and how permissions are used.

The certification bar is a go-to-market problem too

Certification is where the bar steps up sharply, and where the "it is really a product" truth becomes obvious. An app has to be listed for at least six months before the certify option even unlocks. Beyond that, the headline requirements include:

• A minimum of 60 active, unique installs, defined as production HubSpot accounts unaffiliated with your organisation, showing successful activity in the past 30 days. That floor has to be maintained over a trailing six-month period. Drop below it and the certified status is removed, with a six-month wait before you can re-apply.
• A security questionnaire and assessment covering OAuth token encryption, access controls and token lifecycle, plus a scan for outdated software and web-server vulnerabilities, and a verified domain.
• A working Uninstall App endpoint that cleanly removes the app from a customer's Connected Apps when they disconnect, demonstrated on video.
• Assessment across seven quality categories, spanning security and privacy, reliability and performance, usability and accessibility (across the app, the listing and the documentation), and a value score that factors in installs, retention and reviews.

Read that 60-install requirement again. It is a sales and marketing target, not an engineering one. To earn the trust badge that helps you get discovered, you first have to acquire and retain 60 real, unaffiliated customers on the integration. That is a chicken-and-egg distribution challenge that no amount of clean code solves on its own.

Why a listing is a living product, not a finished project

The strongest evidence that this is product work, not a one-off integration, is HubSpot's deprecation schedule. The platform moves, and your app has to move with it. New listings, certifications and recertifications must already run on a supported developer platform version, and the older versions are being retired on a rolling schedule (projects version 2025.1 reaches end of support on 1 August 2026). The v4 APIs are supported until March 2027. Legacy CRM cards are no longer permitted for new listings, and all existing apps have to migrate to app cards by 31 October 2026. On top of that, certification runs on a two-year recertification cycle, with a 90-day notice before expiry.

Put together, that is a permanent maintenance backlog. A listed app commits you to ongoing migration work, security re-assessments and recertification, indefinitely. You are running secure multi-tenant infrastructure, monitored for reliability, graded on live operational quality, with clean lifecycle handling for installs, token refresh and uninstalls. That is the definition of operating a SaaS product.

Build it as a product, or do not build it

At SpotDev we are engineers first, a UK HubSpot Diamond Partner that is also HubSpot Custom Integration Accredited and Cyber Essentials Plus certified. When we take on HubSpot Marketplace app development, we scope it the way it deserves: as a productised solution with an operations and compliance lifecycle, not a configuration job. We build the OAuth flow, the token security, the uninstall handling and the app cards to the certification standard from day one, and we host the result on infrastructure you own outright, so you are never locked to a vendor for the thing your customers depend on.

That sits inside our wider HubSpot development practice. If a full public listing is more than you need today, the lighter building blocks often do the job: a serverless function (from £2,000) or a custom-coded workflow action (from £2,500, requiring Data Hub Professional or higher) can deliver the integration value to a small set of customers without the Marketplace overhead. A Marketplace app itself starts from £18,000, which reflects the product, not just the code. For a fuller picture of the options, our guide on what you can build with custom HubSpot development is a good next read, and the cluster hub at integrations covers the connection side in more depth.

Talk to us before you commit

The worst outcome is starting a listing, hitting the certification wall at 60 installs, and discovering the maintenance commitment after launch. If you are weighing up a Marketplace listing, the readiness conversation is cheap and the rework is not. Request a quote and we will tell you, honestly, whether a public app is the right route for your product or whether a leaner build gets you there faster. We deliver on time, or you get 20% back.

Frequently asked questions

What is the difference between listing and certifying a HubSpot app?

Listing is the entry bar: a public OAuth app that meets HubSpot's content and security basics and passes manual review. Certification is the trust badge on top, requiring at least six months listed, a minimum of 60 active unaffiliated installs maintained over a trailing six-month period, a security assessment and grading across seven quality categories. An app can be listed without being certified, but certification is what genuinely drives discovery and installs.

How many installs do I need to list and to certify an app?

To submit a public listing you currently need a minimum of three active, unique installs in unaffiliated production accounts showing activity in the past 30 days. To certify, you need a minimum of 60 active, unique installs, maintained over a trailing six-month period. HubSpot has revised these thresholds before, so confirm the current figures against its developer docs before you plan.

Do I have to use OAuth for a HubSpot Marketplace app?

Yes. A public Marketplace app must be a public OAuth app, and OAuth must be its sole authorisation method using the authorisation code flow. Pasted API keys or token-entry auth are prohibited, and the app must refresh tokens automatically with no user involvement.

Is a Marketplace app really an ongoing commitment after launch?

Yes. HubSpot deprecates platform and API versions on a rolling schedule, requires migration to app cards, and runs certification on a two-year recertification cycle. A listed app therefore carries a permanent maintenance backlog of migrations, security re-assessments and recertification, which is why it is closer to running a SaaS product than completing a one-off integration.

Do I need a full Marketplace listing, or is there a lighter option?

If you only need to serve a small number of customers, private OAuth distribution (up to 10 customers, or 100 for Solution Partners) avoids the public listing process entirely. For internal automation value, a serverless function or a custom-coded workflow action can deliver the integration without Marketplace overhead. A public listing makes sense when broad discovery and self-serve installs are the goal.