I looked at how 12 of our customers shipped on AppExchange in the last 18 months. The pattern is consistent: their first enterprise deal stalled at procurement until the prospect could find them on AppExchange. The second deal paid back the entire investment. This guide is the full process, the 12-month total cost line by line, the requirements Salesforce actually checks for, and how to get there without signing an $80,000 to $300,000 PDO contract.
TL;DR: Listing on Salesforce AppExchange takes 5 to 9 months end-to-end and costs $25,000 to $300,000 in development, plus a $999 security review fee per paid-app submission, a $150 annual listing renewal, and a 15% revenue share (25% for OEM) on every dollar Salesforce customers spend. The 2026 program follows a 6-stage lifecycle (Plan, Build, Distribute, Market, Sell, Support), and as of May 11, 2026, every AppExchange Connected App must meet the new mandatory security controls. With 91% of the 150,000+ Salesforce customers using at least one AppExchange app and 6,233 apps already listed, the marketplace is the procurement gate most enterprise deals depend on. The second enterprise deal usually pays for the entire listing investment.
What is the Salesforce AppExchange?
The Salesforce AppExchange is Salesforce's official enterprise software marketplace where ISVs distribute managed packages to the 150,000+ companies that run Salesforce. It hosts 6,233 apps from 3,668 unique developers as of December 2025. 91% of Salesforce customers use at least one AppExchange app, which is why most enterprise procurement teams gate on AppExchange presence before signing.
Citation capsule: Counts and ecosystem stats from SFApps.info State of AppExchange 2026. Customer base size from Salesforce corporate materials.
What is the AppExchange listing process?
Salesforce defines a 6-stage product lifecycle: Plan, Build, Distribute, Market, Sell, Support. Stages 1 to 3 cover everything from signing up as a partner to getting your listing live. Stages 4 to 6 cover the ongoing work of selling and supporting your app.
| Stage | What you do | Output |
|---|---|---|
| 1. Plan | Choose your business model (ISVforce vs OEM), define target customer, pick contract type, decide free vs paid | Signed Partner Distribution Agreement (PADA) |
| 2. Build | Develop your app as a 2GP managed package in your Partner Business Org. Apply secure coding standards from day one. | Installable managed package + Solution Architecture Document |
| 3. Distribute | Create your AppExchange listing draft. Submit for security review. Pay $999 (paid apps). Fix findings if needed. Publish. | Live AppExchange listing |
| 4. Market | Optimize listing copy, run AppExchange ads, attend Dreamforce, get reviews from existing customers | Installs + leads from listing |
| 5. Sell | Demo, qualify, close. Use AppExchange Checkout or off-platform billing. Manage renewals. | Paying customers |
| 6. Support | Customer success, patch releases (auto-approved via self-review wizard), annual security review attestation | Retention + expansion revenue |
Source: Trailhead, AppExchange Product Lifecycle module.
What does it cost to publish on Salesforce AppExchange?
The Salesforce fees are small. The dominant cost is engineering. Here's the 12-month total cost of ownership broken into line items, modeled for a typical B2B SaaS company shipping a mid-complexity managed package.
| Cost line item | Range (2026) | What drives it |
|---|---|---|
| Partner Community signup | $0 | Free, just a business email |
| Partner Business Org provisioning | $0 | 1-year trial included with partnership |
| Salesforce development (Apex, LWC, Flow) | $25,000 to $150,000 | Feature count, sharing rules, integration surface |
| Enterprise vertical app (more complex) | $100,000 to $300,000 | Multi-cloud, deep integrations, regulated industries |
| UI / UX design | $5,000 to $30,000 | Number of LWCs, custom pages |
| Security review preparation | $5,000 to $15,000 | Static analysis cleanup, Solution Architecture Document, DAST report |
| Security review fee (paid app) | $999 | Per submission attempt |
| Annual listing renewal | $150 / year | Recurring |
| Listing assets (logo, screenshots, demo video) | $2,000 to $10,000 | Quality of design + production |
| Revenue share to Salesforce (ISVforce) | 15% of net revenue | Ongoing, drops to 10% above $20M cumulative |
| Revenue share to Salesforce (OEM) | 25% of net revenue | Ongoing, drops to 15% above $20M cumulative |
| Year-one total (traditional path) | $38,000 to $206,000+ | Before rev share on listing-sourced revenue |
Cost ranges from Noltic's AppExchange cost breakdown, Magicfuse pricing analysis, and Salesforce ISVforce Guide.
How long does it take to get listed?
Realistic end-to-end timeline: 5 to 9 months for a first-time listing. The dev work dominates. The security review is the second-biggest block. Roughly half of first-time security review submissions fail, adding 2 to 3 weeks per resubmission.
| Milestone | Duration |
|---|---|
| Partner Community signup and approval | 1 to 2 weeks |
| Partner Business Org provisioning | 1 to 3 business days |
| 2GP managed package development | 8 to 20 weeks |
| Pre-submission validation (sfdx-scanner, docs) | 1 to 2 weeks |
| Security review (intake to result) | 4 to 8 weeks (9+ during Dreamforce season) |
| Security review resubmission (if needed) | 2 to 3 weeks per cycle |
| Listing creation in Partner Console | 1 to 2 weeks |
| End-to-end (no resubmissions) | ~5 months |
| End-to-end (typical with 1 resubmission) | ~7 months |
| End-to-end (complex enterprise app) | 9 to 12 months |
What are the requirements to publish a paid app?
Salesforce will not let you submit until every item below is in place. Most first-time failures come from missing or weak versions of items 4, 5, and 8.
- Partner Business Org (PBO) provisioned and in active status.
- 2GP managed package (recommended over 1GP) installable from a release version.
- Signed Partner Distribution Agreement (PADA).
- Detailed solution user documentation uploaded to the Partner Security Portal. Data flows, integration surface, sharing model, and every external endpoint the package calls.
- Source code scanner output from sfdx-scanner (Chimera was retired June 16, 2025). Plus a DAST report from OWASP ZAP, Burp Suite, or Qualys.
- Test org with credentials pre-loaded with realistic data, login steps documented.
- Listing copy: title, tagline, full description, key features list, category tags.
- Marketing assets: logo, screenshots, demo video under 3 minutes (ideally around 1 minute, HD).
- Pricing definition with AppExchange Checkout configured or external billing documented.
- Support process and contact URLs.
- Security review fee paid ($999 for paid apps, $0 to $1 for free apps).
Companion read: Our deep dives on the AppExchange security review and the security review checklist go line by line through what reviewers look for.
How does AppExchange revenue share work?
ISVforce partners pay Salesforce 15% of net subscription revenue. OEM partners pay 25%. Both drop after $20 million cumulative revenue.
| Revenue model | Standard rate | After $20M cumulative | When to choose |
|---|---|---|---|
| ISVforce | 15% of net subscription revenue | 10% | Selling to companies that already own Salesforce licenses |
| OEM (Embedded) | 25% of net subscription revenue | 15% | Bundling a hidden Salesforce license inside your product |
| Free app | 0% | 0% | Lead-gen apps with paid SaaS billing off-platform |
AppExchange Checkout vs off-platform billing
If you use AppExchange Checkout for credit-card processing, Salesforce adds a $0.30 Stripe transaction fee per charge on top of the 15% revenue share. If you bill off-platform (invoicing the customer directly with your own billing stack), you skip the Stripe fee but still owe the 15% report-and-remit. Most enterprise SaaS companies choose off-platform billing because their customers prefer invoice payment terms.
Citation: Revenue share percentages from Salesforce Developer Docs, AppExchange Checkout Revenue Share. $20M marginal royalty bands per Magicfuse Partner Agreement analysis.
How do you build an app for Salesforce AppExchange?
The build process is where 80% of the time and 90% of the cost goes. There are three viable paths.
| Path | Cost | Time | Best for |
|---|---|---|---|
| Hire in-house Salesforce engineers | $150,000+ per dev per year | 6 to 12 months to first listing | Companies planning multiple AppExchange products long-term |
| Contract a PDO (Product Development Outsourcer) | $80,000 to $300,000+ one-time | 6 to 12 months | Companies that need their first listing fast and have one-time budget |
| AI-native managed-package generator (Appnigma) | Subscription pricing | ~8 weeks to listing including security review | B2B SaaS companies without Salesforce developers |
Whichever path you pick, the technical output must be the same: a 2GP managed package that follows Salesforce's secure coding standards, installs cleanly into a customer's org, exposes the right metadata for AppExchange listing, and passes Checkmarx and Salesforce Code Analyzer scans.
Is it worth listing your SaaS product on AppExchange?
The clearest answer comes from the math: at typical B2B enterprise ACV, the second deal pays for the entire listing.
What an AppExchange listing actually buys you
Three things, and it is worth being precise about them because only one is traffic.
| What you get | What it means in a deal | Who it matters to |
|---|---|---|
| Credibility | Salesforce has run a security review against your package, so procurement and IT treat you as a vetted vendor rather than an unknown one | Enterprise buyers with a vendor review process |
| Distribution | Buyers already searching the marketplace can find you, install a trial into a sandbox, and evaluate without talking to sales | Mid-market and enterprise admins sourcing tools |
| Partnership eligibility | A live listing is the entry requirement for co-selling motions, industry programmes and Salesforce partner tiers | Teams building a Salesforce channel |
The credibility line is the one that closes deals. Most teams list because a specific deal stalled when the prospect could not find them on the marketplace, not because they expect the listing itself to be a lead source.
| What you get | What it means in a deal | Who it matters to |
|---|---|---|
| Credibility | Salesforce has run a security review against your package, so procurement and IT treat you as a vetted vendor rather than an unknown one | Enterprise buyers with a vendor review process |
| Distribution | Buyers already searching the marketplace can find you, install a trial into a sandbox, and evaluate without talking to sales | Mid-market and enterprise admins sourcing tools |
| Partnership eligibility | A live listing is the entry requirement for co-selling motions, industry programmes and Salesforce partner tiers | Teams building a Salesforce channel |
High-ROI signals (worth it)
- Your ICP is enterprise or mid-market on Salesforce. Deals routinely stall at "is it on AppExchange?"
- Procurement-led buying, with security and vendor review parity required.
- Average ACV above $25,000. Two deals at $50,000 ACV with 3-year LTV pays back $300,000.
- You're already paying the Salesforce tax: integrations, consulting hours, support tickets routed through SF.
Low-ROI signals (skip or delay)
- SMB-only target. ACV under $5,000.
- No structural Salesforce dependency in your customer's workflow.
- Product is a thin wrapper that competes with native Salesforce features.
- Team has zero Salesforce knowledge and no budget for a PDO.
The math: how the second deal pays for the listing
| Scenario | Cost | Break-even |
|---|---|---|
| Mid-complexity app, no resubmission | $80,000 | 1 deal at $50K ACV times 3-year LTV (after 15% rev share) |
| Mid-complexity app, 1 resubmission | $95,000 | 1 deal at $50K ACV times 3-year LTV |
| Complex enterprise app, in-house team | $300,000 | 2 deals at $100K ACV times 3-year LTV |
| AI-generated package (Appnigma) | Subscription, orders of magnitude lower | First deal often pays for the year |
AppExchange against your other channels
Listing is not free of trade-offs. You give up margin and some control in exchange for distribution and trust, so it is worth being explicit about what each channel does for a Salesforce-adjacent app.
| Channel | What it gives you | What it costs |
|---|---|---|
| AppExchange listing | Inbound discovery, and procurement credibility with enterprise buyers | Revenue share on listing-sourced deals, security review, ongoing maintenance |
| Direct sales | Full margin and full control of the relationship | You carry the entire cost of discovery and of proving you are safe to buy |
| Salesforce co-sell | Access to AE-led deals and warm introductions | Requires references and a track record before it is available to you |
| Partner and reseller | Reach into accounts you cannot address yourself | Margin share plus enablement work that never really finishes |
Most ISVs run AppExchange alongside direct sales rather than instead of it. The listing earns the inbound and the credibility, and the direct motion closes the deals that never needed either.
After you list, the part most teams skip
A listing is a storefront, not a growth channel on its own. The teams that see a return treat the first 90 days as a launch rather than a completion.
- Seed reviews from design partners in week one, because ratings feed marketplace ranking.
- Publish a demo org so a buyer can evaluate without booking a sales call.
- Start co-sell conversations with Salesforce account executives once you have references to point at.
- Keep the listing maintained, since marketplace search favours apps that are actively updated.
The pattern behind all four: the listing is evaluated by people, and the signals they read are recency, reviews and whether they can try it. A listing published and left alone produces the outcome most teams then attribute to the marketplace itself.
Can you list on AppExchange without Salesforce developers?
Yes. The work still has to be done by people who know Salesforce, but it does not have to be your people. A specialist engineering partner builds the managed package, writes the user documentation the security review asks for, and produces the scan reports, so your team never hires a Salesforce developer. The point is that the code follows Salesforce's secure coding standards from the start, which is what clears Checkmarx and Salesforce Code Analyzer on the first pass.
Appnigma is a done-for-you engineering service built by ex-Salesforce AppExchange engineers, and every managed package we ship includes:
- 'with sharing' declared on every Apex class touching user data
- WITH SECURITY_ENFORCED on every SOQL query, or Security.stripInaccessible when dynamic
- Bind variables in every dynamic query, no string concatenation
- Output encoding applied in Visualforce and template binding in LWC
- Named Credentials for every external endpoint, no hardcoded secrets
- Solution user documentation and DAST reports prepared against the package metadata, in the shape the security review expects
Companies that have shipped Salesforce integrations with us include Warmly, Salesbricks, Hyperbound, Pylon, Seam AI, UserEvidence and Monk. None of them hired a Salesforce dev team to do it.
One kickoff call, and we build the 2GP managed package that clears security review. One flat price, never hourly, and the IP is yours. Book a call.
What changed for AppExchange listings in 2026?
Three structural changes between 2023 and May 2026 broke most older AppExchange listing guides.
| When | What changed | What it means |
|---|---|---|
| March 16, 2023 | Security review fee moved to $999 per submission. Self-review wizard introduced for version updates. | Failure is more expensive. Successful first listings get auto-approved updates. |
| June 16, 2025 | Chimera DAST was retired. | Partners must now run OWASP ZAP, Burp Suite, or Qualys against the demo org and submit the report. |
| May 11, 2026 | Mandatory Connected App and External Client App security controls became required. | Every AppExchange listing must comply or be removed. Source: Aquiva Labs. |
The May 11, 2026 deadline just hit. If your AppExchange app uses Connected Apps for OAuth or External Client Apps for callouts, you must have the new security controls in place by now. Apps without compliant configuration risk being delisted. The Spring '26 ISVforce Guide v66.0 published April 30, 2026 documents the exact requirements. Aquiva Labs deep dive.
Frequently asked questions
How do I list my app on Salesforce AppExchange?
Salesforce defines a six-stage product lifecycle: Plan, Build, Distribute, Market, Sell, Support. In practical terms: join the Partner Community at partners.salesforce.com, get a Partner Business Org, build your app as a 2GP managed package, sign the Partner Distribution Agreement, submit for security review with the $999 fee, and after passing, create your listing in the AppExchange Partner Console. End-to-end, expect 5 to 9 months for a first-time launch.
What does it cost to publish a Salesforce AppExchange app?
Partner Community signup is free. The security review costs $999 per submission for paid apps. The annual listing renewal is $150. Salesforce takes a 15% revenue share on net subscription revenue (or 25% for OEM). Development cost ranges from $25,000 to $150,000 with a traditional Salesforce dev shop, or $100,000 to $300,000 for complex enterprise vertical apps.
How long does it take to get an app on the Salesforce AppExchange?
Realistic end-to-end timeline is 5 to 9 months for a first listing. Partner Community signup takes 1 to 2 weeks. Partner Business Org provisioning takes 1 to 3 business days. Development takes 8 to 20 weeks. Pre-submission validation takes 1 to 2 weeks. The security review takes 4 to 8 weeks for an initial pass. Roughly half of first-time submissions fail, adding 2 to 3 weeks per resubmission.
How does the Salesforce AppExchange revenue share work?
ISVforce partners pay Salesforce 15% of net subscription revenue (10% above $20 million cumulative). OEM partners pay 25% (15% above $20 million). If you use AppExchange Checkout for credit-card billing, add a $0.30 Stripe transaction fee per charge. Free apps incur no revenue share. Off-platform billing is still subject to the 15% report-and-remit obligation unless contractually exempt.
What are the requirements to publish a paid app on Salesforce AppExchange?
A Partner Business Org, a 2GP managed package, detailed solution user documentation, a demo video under 3 minutes, screenshots and logo, listing copy, pricing definition, support process and URLs, test org credentials for the security review team, source code scanner output, and a passing security review. Paid apps also require the $999 review fee.
Is it worth listing my SaaS product on the Salesforce AppExchange?
If your target buyer is an enterprise or mid-market company that uses Salesforce, and your deals are routinely blocked by 'is it on AppExchange?', listing is worth it. The second deal pays for the listing at typical ACV. If your ICP is SMB with sub-$5K ACV, or your product has no structural Salesforce dependency, skip it. 91% of Salesforce customers use at least one AppExchange app.
Can I list on AppExchange without Salesforce developers?
Yes, in the sense that you do not need Salesforce engineers on your own payroll. Appnigma builds the 2GP managed package, the secure Apex, the solution user documentation and the DAST reports for you, as a done-for-you engineering service. Companies including Warmly, Salesbricks, Hyperbound, Pylon, Seam AI and UserEvidence listed on AppExchange without hiring a Salesforce engineering team.
What changed for AppExchange listings in 2026?
Two structural changes hit in 2025 to 2026. First, mandatory Connected App and External Client App security controls became required on May 11, 2026. Second, the Chimera DAST scanner was retired on June 16, 2025. The Spring '26 ISVforce Guide v66.0 (April 30, 2026) is the canonical current spec.
Where to go next
This pillar is the hub. The deep dives:
- The 2026 Salesforce ISV Partner Program guide. Tiers, costs, ISV vs OEM, and the path to becoming an ISV.
- The 2026 Salesforce security review guide. Fees, timeline, what they check, and the top 10 failure causes with code-level fixes.
- The 2026 managed package guide. What you're submitting for security review and how the packaging model works.
- How to build a managed package without hiring Salesforce engineers. The done-for-you path Appnigma's customers take.
- Salesforce Partner Business Org explained. The org where you'll build everything.
- Appnigma for AppExchange. How AI-generated managed packages cut your time-to-listing.
Sources
- SFApps.info, State of AppExchange App Analytics 2026
- Salesforce, 10 Million AppExchange Installs
- Trailhead, AppExchange Product Lifecycle
- Salesforce ISVforce Guide, Create Your AppExchange Listing
- Salesforce ISVforce Guide, AppExchange Checkout Revenue Share
- Salesforce ISVforce Guide v66.0 Spring '26 PDF (April 30, 2026)
- IDC (2023), AI-Powered Salesforce Economy: 11.6M jobs, $2.02T by 2028
- Noltic, How Much Does It Cost to Build an AppExchange App
- Magicfuse, AppExchange Pricing and Monetisation
- Aquiva Labs, Mandatory Connected App Security Requirements (May 11, 2026 deadline)
- Beyond The Cloud, AppExchange Publication Checklist
