How do I list my app on Orshot?

Once your app is working and ready for users, you can request distribution. After review, any Orshot user can connect your app.

Distribution Statuses#

Your app goes through these stages:

Before You Submit#

Make sure your app meets these requirements:

• Working OAuth flow: Users can connect and disconnect their Orshot accounts
• Proper error handling: Graceful handling of denied access, expired tokens, and API errors
• Minimal scopes: Only request permissions your app actually needs
• Clear purpose: The app solves a real use case for Orshot users
• Privacy policy: A URL explaining how you handle user data

What to Include#

We review the details you entered when you registered your app. Your app needs an icon before you can request distribution: a square PNG, JPG, WebP or GIF, at least 128×128px, up to 2 MB.

Submit for Review#

Open your app in the developer dashboard and click Request Distribution. While the request is pending, you can click Cancel Request to withdraw it.

Open the Developer Dashboard →

Review Process#

1. Request: Click Request Distribution in the developer dashboard
2. Review: We test the OAuth flow, check scopes, and evaluate the user experience
3. Feedback: We may request changes or ask clarifying questions
4. Approval: Your app is approved (Published or Distributing)
5. Live: Orshot users can authorize and use your app

After Approval#

Once approved, your app can be in one of two states:

Published#

• All Orshot users can authorize your app — sandbox restrictions are removed
• Users need a direct link to connect your app

Distributing#

• The same as Published: any Orshot user can authorize your app
• Users need a direct link to connect your app

For both states:

• Changes you save in the dashboard, including scopes and redirect URIs, apply right away
• Tell us when you add scopes so we can re-check your app

Guidelines#

• Don't abuse tokens: Only access data your app needs for its stated purpose
• Handle disconnections: If a user revokes access, stop making API calls
• Rate limits: OAuth endpoints allow 60 requests per minute per IP address
• Keep secrets secret: Never expose your client_secret in client-side code or public repos
• Be transparent: Clearly explain to users what data you access and why