--- title: "Listing and publishing your app" description: "What a BankSync app listing needs before review: screenshots, a publisher profile, an accepted Developer Agreement — plus what re-enters review after verification and what publishes straight away." section: "Apps" canonical: "https://banksync.io/docs/apps/app-listing" specs: ["apps"] operationBindings: [{"capability":"apps","operation":"apps.listing.preview"},{"capability":"apps","operation":"apps.listing.update"},{"capability":"apps","operation":"apps.media.upload"},{"capability":"apps","operation":"apps.media.update"},{"capability":"apps","operation":"apps.media.reorder"},{"capability":"apps","operation":"apps.media.delete"},{"capability":"apps","operation":"apps.publisher.get"},{"capability":"apps","operation":"apps.publisher.update"},{"capability":"apps","operation":"apps.agreement.accept"}] --- A listing is what a stranger sees before they decide to install your app: on the BankSync directory, on the website, and at the top of the install screen. This page is what you need to assemble, what review looks at, and which later edits go live immediately versus which go back through review. Everything here assumes you have already registered the app and published a manifest — see [Building a BankSync app](/docs/apps/apps-reference). > **Before you start:** 'You need the Admin or Owner role in the workspace that owns the app. Listing fields are edited on the app detail page under Developers → Apps; the publisher profile is shared by every app your workspace publishes.' ## The publisher profile Your apps are published under a **publisher**, owned by your workspace and shared by every app it publishes. It is what turns "Acme Tax" into "Acme Tax, by Acme Ltd". | Field | Notes | | -------------- | ---------------------------------------------------------------- | | `name` | Required. 1–120 characters. Rendered on the card as `By {name}`. | | `url` | Optional. Up to 2048 characters. | | `supportEmail` | Optional. Up to 320 characters. | | `verified` | Set by BankSync, not by you. | The profile also records which version of the **Developer Agreement** you accepted and when. You accept it before your first app is created; app creation is refused until you have, and you are asked again when the version changes. ## What a listing is made of | Field | Public | Notes | | -------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------- | | Name | yes | What the install screen says. | | Slug | yes | `^[a-z0-9][a-z0-9-]{2,39}$`, unique across BankSync. **Frozen once verified** — it is your connect link and your listing URL. | | Logo | yes | PNG, JPEG or WebP, up to 1 MB. Square works best. | | Short description | yes | One line, on cards, the install header and the website hero. | | Description | yes | The long one. Plain text with paragraphs and links; raw HTML and markup are refused, and links render `nofollow`. | | Screenshots | yes | 1–6 images, JPEG/PNG/WebP, ordered, each with an optional caption. | | Demo video | yes | Optional, and **not self-serve in v1** — BankSync staff register a video for you on request. | | Publisher | yes | From the profile above. | | Category and tags | yes | Category from the fixed list; up to ten tags. | | Website | yes | Required at review. | | Privacy policy, terms | yes | Required at review. Linked from the install screen's data-usage panel. | | Support email, support URL | yes | Where users reach you. | | Pricing note | yes | Free text, one line, e.g. "Free with a BankSync plan". There is no billing integration behind it. | | Countries, data types | yes | **Derived from your manifest.** Never authored. | | Data usage | yes | **Derived from your requested scopes and manifest egress.** Never authored. | | Verification badge | yes | `draft`, `unverified`, `in_review`, `verified`, `suspended` or `first_party`. | | Install count | yes | Shown publicly as a **bucket** — `none`, `1-10`, `11-50`, `51-200`, `200+` — and exactly in your own console. | | Listed | — | Whether you appear in the directory. Only a verified app can turn it on. | > **You do not write the sentence that describes what you take:** 'Countries, data types and the data-usage panel are computed from your manifest and your requested scopes. This is deliberate: a builder-authored description of their own data access is exactly the sentence that would drift from the truth, and it is the one a user relies on most.' > **Preview before you submit:** 'The console renders two previews from your draft: the listing page as the website will show it, and the install screen as a user will see it. Both use the same projection the public surfaces use, so what you preview is what ships.' ## Before review: the checklist Submitting for review is refused until all of these are in place: - **Identity** — Logo, short description, long description, and a complete publisher profile. - **Media** — At least one screenshot. Every image is moderated, so it carries its own review state. - **Links** — Homepage, privacy policy, terms of service, and a support email. - **Agreements & manifest** — An accepted Developer Agreement, and a manifest version in draft or approved. ## What review looks at Review is a human read, and it is stricter than a completeness check. Approval requires: - **Privacy policy and terms present**, and reachable. - **Declared egress that matches the requested scopes.** An app that asks for more than it uses, or moves data it did not declare, is rejected. - **The installer-email consent line present** wherever you ask to see users' email addresses. - **A connectivity profile inside the markets BankSync permits.** You may narrow yourself; you cannot self-certify into a market that is closed. - **No presenting account information as your own service.** An app that markets "connect your bank" as its own product, or ships a multi-bank account dashboard as its product, is rejected. The line matters because presenting account information as a service is a regulated activity in its own right (the FCA's Approach Document §5.8–5.10); BankSync is the party holding that permission, which is also why bank consent screens name the provider and BankSync rather than your app. Rejections come back with a reason from a fixed set, so you get a specific fault rather than "declined". > **Ten installs until you are verified:** 'An unverified app can be installed by connect link, but it is capped at ten active installs and never appears in the directory. A revoke that removes the last grant uninstalls the app and frees a slot. Submit for review before you need the eleventh.' ## Going live Once verified you get the badge, and a **Listed** toggle. Listing is a choice: a verified app that stays unlisted still installs perfectly well through its connect link, it just does not appear in the BankSync directory or on the website. Turning it on is refused for anything that is not verified, server-side — sending the flag does not bypass review. Your slug freezes at verification, because it is both your connect link and your public URL. ## Editing after verification Two classes of edit, with different consequences: | Edit | What happens | | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | Short description, long description, links, category, tags, pricing note, support URL | **Publishes immediately.** No review. | | A new or replaced screenshot, or a new demo video | **Re-enters review.** Media is moderated. | | A publisher name change | **Re-enters review.** It is the identity users saw. | | Widening the manifest — more scopes, or more egress | **Re-enters review**, and does not reach installed users until it is approved. | | Narrowing the manifest, or an unrelated manifest change | Publishes as a new version; installed users stay on the version they consented to until they accept the new one. | Reordering or captioning existing screenshots is a text-level edit; adding or replacing an image is not. > **Existing installs are not moved:** 'A new manifest version does not retroactively change what an installed workspace consented to. Users stay on their version until they accept the new one — so widening scopes reaches your existing installs on their schedule, not yours.' ## Not in v1 - **Self-serve demo video upload.** Staff register a video from the BankSync CDN on request. - **A per-app changelog.** There is nowhere to publish "what changed in this version". - **Deprecation and sunset.** Retiring an app has no built-in notice to installed users. - **Sponsorship or developer-pays billing.** Installs are user-pays; builders earn through the existing affiliate attribution carried by the connect link. - **Distribution of custom widget code.** Apps ship dashboard and widget *templates* only. ## Related guides - [Building a BankSync app](/docs/apps/apps-reference) — the manifest, the install lifecycle and your endpoint. - [The connect link](/docs/apps/connect-link) — the hosted install flow your listing's CTA points at. - [App branding & logo](/docs/apps/app-branding) — uploading the logo and filling in the consent-screen details. - [Register an OAuth app](/docs/apps/registering-an-app) — the app record and its client credentials.