A public Marketplace app is closer to a multi-tenant SaaS product than a point integration, and we build it as one. SpotDev is the software engineering firm for HubSpot customers, so we engineer the OAuth backend, UI extensions, webhooks and billing layer a listing actually needs.
A public app is a productised, multi-tenant integration that any HubSpot customer can discover and self-install via OAuth. It opens a distribution channel a private integration cannot, but it carries the engineering load of a hosted product.
You already run a single-portal integration and want to turn it into a public app any HubSpot customer can self-install. We re-architect it as a multi-tenant build with per-portal OAuth, isolated token storage and install-driven provisioning, so one codebase serves every connected account.
You are a software vendor and your customers expect a first-party HubSpot integration. We build the two-way CRM sync, ship the Marketplace listing with an accurate shared-data table, and meet the listing prerequisites including a verified domain, live setup docs and matching pricing.
You want billing, support, logistics or product-usage data visible on the contact or deal record without staff leaving the CRM. We build UI extensions and app cards with the HubSpot UI extensions React library that fetch your data at runtime through hubspot.fetch() and render in the record tab, sidebar or preview.
You need to react to CRM events the moment they happen, for example a deal stage change triggering provisioning, invoicing or onboarding. We implement webhook subscriptions with signature validation and a resilient processing pipeline, well within the per-app subscription limits.
You want customers to configure and operate the integration entirely inside HubSpot. We build app pages and settings pages so onboarding, configuration and day-to-day use happen in-product, which reduces support load and improves activation.
You want the trust, prominence and certified-app search filter that certification brings. We build to the certification bar from day one, including the security questionnaire requirements and a sustained activity success rate above 95 percent, so the badge is achievable once your install and tenure thresholds are met.
We engineer the full app, not just the HubSpot-facing surface, because a public listing depends on infrastructure HubSpot does not provide.
We define the app boundary, the minimal OAuth scope set you actually use at install, the objects and events in play, and the hosting topology. OAuth is the only permitted authorisation method for a public app, so we design the authorisation-code flow, encrypted token storage and refresh handling up front. We also confirm which scopes map to which customer Hub or tier, since some objects an app touches require the customer to hold the relevant subscription.
We stand up the self-hosted backend that every public app requires: token exchange and secure encrypted storage keyed by portal ID, refresh handling, and an API client that respects the public-app limit of roughly 110 requests every 10 seconds per connected account using batching, caching and back-off. Public apps are not subject to daily call caps, so we tune for per-account concurrency rather than a global ceiling.
We implement the webhook subscriptions for the CRM events the app reacts to, with a verified endpoint and signature validation, plus the install and uninstall lifecycle. That includes the required Uninstall App API call so access is revoked cleanly, and OAuth plus webhook signals that drive your licensing and entitlement logic.
We build the in-product UI with the HubSpot UI extensions React library, initialised through hubspot.extend(), rendering in CRM card locations such as the record tab, sidebar and preview, plus settings pages and app pages where needed. We use the current supported developer-platform version and the HubSpot CLI within Developer Projects, fetch data through hubspot.fetch() within its concurrency, timeout and payload limits, and avoid sensitive-data scopes inside app cards and any deprecated legacy CRM cards.
HubSpot handles distribution, install, OAuth and permissions but does not bill on your behalf, so we build the commercial layer: portal-ID-to-customer mapping, subscription, trial and renewal logic, and runtime entitlement checks. We then prepare the listing assets, verified domain, setup docs, Terms of Service and Privacy Policy, and a demo walkthrough, and set you up to clear the listing thresholds and pursue certification when your install count and tenure allow.
Everything you need to know about our services
Our public Marketplace app engagements start from £18,000, and that figure is indicative rather than fixed. The real driver is scope: how many integrations and objects are in play, the data volume and sync complexity, how much in-product UI you need, whether you want certification, and how much of the monetisation and entitlement layer we build. A public app sits at the upper end of HubSpot integration work because it is a hosted multi-tenant product with its own OAuth backend, webhooks, React UI and billing logic, not a single-portal integration. We scope precisely and work fixed-price wherever the requirements allow, backed by our guarantee: delivered on time, or you get 20 percent back.
Yes. SpotDev is the software engineering firm for HubSpot customers, with an in-house engineering team and our proven Default to Build process. We are a HubSpot Diamond Partner and HubSpot Custom Integration Accredited, and we hold Cyber Essentials Plus, which matters because certification now requires a security questionnaire covering encryption, access control and token lifecycle. Our own website is built with React UI work and HubSpot serverless functions, so the capability is real and not theoretical. We build productised, customisable solutions hosted on Railway that you can run yourself, which is exactly the shape a multi-tenant Marketplace app needs.
No. Development happens in a free HubSpot App Developer account plus developer test accounts, using OAuth and the HubSpot CLI within Developer Projects. The gates are thresholds, not subscription tiers: listing needs at least 3 active unaffiliated installs, a verified domain, Terms of Service and Privacy Policy, and agreement to the Technology Partner Program Agreement. On the customer side, public apps and the Webhooks API work across every subscription level from free to Enterprise, though specific objects or scopes your app touches may require that customer to hold the relevant Hub or tier.
No, and this catches many vendors out. HubSpot's role stops at distribution, install, OAuth and permissions. There is no native paid-versus-free enforcement and no Marketplace recurring-revenue payout. You are responsible for pricing, billing, subscriptions, trials, renewals and access control. We build that layer for you: mapping each HubSpot portal ID to a customer record in your own system, checking entitlement at runtime, and using install and uninstall events to grant and revoke access. Your listing pricing must also match the pricing on your own website, and Free can only be used for genuine free-forever or freemium models.
Certification has higher bars than listing. You need at least 60 active, unique installs from accounts unaffiliated with your organisation, and your app must have been listed on the Marketplace for at least 6 months before the certify button activates. You must run on a supported developer-platform version, pass a security questionnaire, avoid deprecated legacy CRM cards, and sustain an average activity success rate above 95 percent. HubSpot responds within roughly 10 business days and the full review takes no more than around 60 days. Certification is valid on a 2-year rolling basis. We build to that bar from the start so certification is a milestone rather than a rebuild.
A private app is scoped to a single portal and can use a private-app access token, with daily call limits that depend on the customer's subscription. A public Marketplace app must use OAuth as its sole authorisation method, serves many tenants at once, and is discoverable and self-installable by any HubSpot customer. It is not subject to daily call caps but is rate limited at roughly 110 requests every 10 seconds per connected account, and it requires you to host your own OAuth backend and, for UI extensions, a REST backend. In short, a public app is a hosted product, which is why we approach it as a multi-tenant SaaS build.
Decision-stage reading to help you scope the right approach.
What a public listing requires, and the install and certification bar to expect.
How to decide between an off-the-shelf app and a bespoke build.
