The Salesforce app marketplace is AgentExchange. It was known as AppExchange until April 14, 2026, when Salesforce merged it with Slack Marketplace and the Agentforce ecosystem into one store, per Introducing the new AgentExchange. To get a SaaS product listed you need a partner account, a passed security review and an approved listing. The decision that shapes the launch comes first. Will you list an API integration that runs in your cloud, or a managed package that installs in the customer's org?
That choice decides what the customer installs, which Salesforce billing and licensing tools you can use, and how much Salesforce engineering the launch needs. Appnigma's marketplace apps team builds native Salesforce apps for SaaS companies and covers "a native app, marketplace listing preparation, and review support." Admins shopping for an app rather than selling one will find the buyer side in our explainer on what Salesforce AppExchange is.
Updated October 2026. Checked against Salesforce's ISVforce Guide, the AgentExchange install guide and the Salesforce newsroom. The earlier version never mentioned AgentExchange, used app counts from an older source, and said an integration that runs outside Salesforce can't be listed. Salesforce documents an API listing type for exactly that case. This update replaces the counts with dated official figures, corrects the listing rules, and adds the launch steps in the order Salesforce asks for them.
What the move to AgentExchange changes for a vendor
Salesforce marketplace, SFDC marketplace, Salesforce app store and AppExchange are all names for one storefront, which Salesforce's docs now call AgentExchange. The install guide says Salesforce has "unified AppExchange, AgentExchange, and Slack Marketplace into a single destination," per What Is AgentExchange?. The old appexchange.salesforce.com address still opens it. One search result that looks related is not. The "marketplace apps" in Marketing Cloud Intelligence are data connectors inside that product, not the app store.
For a vendor the rename changed less than it sounds. The partner program, the ISVforce Guide, the security review and the Listing Builder are the same process, now labelled AgentExchange. What did change is the shelf your listing sits on. Your app now appears next to Slack apps and Agentforce agents, and the launch list includes "in-product discovery of AgentExchange inside Agentforce Builder," per the AgentExchange launch page. Salesforce also lists an Agentforce Solution type for packages that contain Agentforce elements such as actions and templates, per Solution Types. If your product could expose an agent action, that is now a listing decision too.
Size figures for the store vary by page and date. At the April 2026 launch Salesforce counted 10,000 Salesforce apps, per the Headless 360 announcement. Quote one figure with its source and date rather than a round number from an old article.
Can an integration that runs outside Salesforce be listed?
Yes. Salesforce says partners "can distribute packaged solutions and APIs on AgentExchange," per Solution Types. A Salesforce Platform API solution is "a solution that interacts with the Salesforce Platform by using REST API, SOAP API, or other Platform APIs." So a SaaS product that syncs with Salesforce from its own cloud can have a listing without shipping any code into the customer's org.
What changes is what the customer gets and which tools you get. The table below sets the two routes side by side.
| Question | API listing | Packaged solution (managed package) |
|---|---|---|
| What the customer installs | Nothing from the listing. "API solutions can't be installed directly from AgentExchange" | A managed package installed into their org from the listing |
| Security review | Required | Required |
| AgentExchange Checkout billing | Not available, Checkout needs a managed package | Available to eligible partners |
| License Management App | Not available, only managed packages register | Available |
| Push upgrades to customer orgs | Not applicable | Available after the package passes review |
| Salesforce engineering needed | Your API integration and its auth | Apex, Lightning components, packaging and tests |
The install line is from Installation Methods, and the review line from How the AgentExchange Security Review Works, which names "Salesforce Platform API solutions" alongside managed packages. Checkout requires that you "distribute your solution in a managed package," per the Checkout overview. The licensing tools note that "you can register only managed packages," per Set Default Licensing. Push upgrades are limited to packages "that have passed the AgentExchange security review," per Push Upgrades.
How to read that table for a SaaS product. An API listing is the lighter launch when your value lives in your own app and Salesforce is a data source. A managed package earns its extra build when customers want your features inside Salesforce screens, when you want Salesforce to bill and license for you, or when your sales team keeps hearing "does it run in Salesforce?" Our guide to what a managed package is explains what the customer can and can't see once it is installed.
The steps from partner signup to an Install button
Salesforce summarizes the path in two lines. You start "by joining the Partner Community." Then you build, sign a commercial agreement, pass the security review and publish, per Become an ISV Partner. In practice the order looks like this.
- Join the partner program. Your Partner Business Org (PBO), the org that owns your packages and listings, "is provisioned when you join the Salesforce Partner Community," per Partner Business Org. Salesforce describes a revenue share model rather than a joining fee, and the share starts only after you first report revenue, per the Become a Partner FAQ.
- Start the commercial agreement. Before you submit for review, a partner recruitment representative has to confirm your enrollment and "that you have a distribution agreement," per Submit Your Solution for Security Review.
- Build the solution. For a package, Salesforce recommends "that everyone use managed 2GPs to create new apps," per Use Managed Packages. A version must pass "a 75% code coverage requirement before it can be promoted," per Get Ready to Promote and Release. Salesforce "can't accept an unmanaged or beta package" for review.
- Pass the security review. The review covers your package and any external services it calls. Plan on "approximately 4 to 6 weeks after you submit," per Act on Security Review Results.
- Build and approve the listing. You "can link a solution undergoing security review, but you can't publish on AgentExchange until it passes," per the Listing Builder overview. Salesforce checks the listing against "partner brand guidelines and partner program policies," per Get Your Listing Approved.
- Sign the PADA and publish. "After your listing is approved, you must sign a Partner Application Distribution Agreement (PADA) before it can be published," per the same approval page. Trailhead says the listing is live about 30 minutes after you click Publish, per Review Your Work and Publish.
Only the build and the review hold real calendar time. Steps 2, 5 and 6 can run while the package is being built or reviewed, which is why teams that start the agreement on day one launch weeks earlier than teams that start it when the code is done. Our post on how long it takes to get an app on AppExchange turns these stages into a launch date, and the step by step listing guide walks through each Listing Builder screen.
Choices you can't change after you make them
Three early choices in an AgentExchange launch can't be reversed, and first-time ISVs tend to make them fastest.
The listing type is fixed. "You can't change the listing type after it's created," per Select a Listing Type. If you start with an API listing and later ship a package, plan for a second listing rather than a conversion.
The namespace is fixed too. Your namespace is the prefix on every component in your package, and it "must be globally unique across all Salesforce orgs," per Register a Namespace. For 2GP, Salesforce says that after you create a package "you can't change or add a namespace" or move it to another Dev Hub, per the 2GP workflow. Pick it with your brand team, not in the first sprint.
Promotion is one way. Once a version is released, "you can't reverse the promotion," per Get Ready to Promote and Release. Components you release become part of what every future upgrade has to carry, so a rushed first version shapes the package for years.
What the security review looks at first
Every publicly listed app and API solution passes the security review, free or paid. For packages, the single biggest risk is permission handling in code. Salesforce's own analysis says "CRUD/FLS enforcement vulnerabilities are the top reason (by a significant margin)" for failing the review, per The Top 20 Vulnerabilities Found in the AppExchange Security Review. CRUD and FLS are object and field level permissions, meaning code has to respect what the running user is allowed to read and edit.
The fix Salesforce recommends is user mode. Its secure coding guide says to "use USER_MODE" so that queries and DML follow the running user's sharing rules and permissions. The same page notes that "WITH SECURITY_ENFORCED isn't allowed in AppExchange packages," per Protect from CRUD/FLS Vulnerabilities. That one detail is worth checking in any package you inherit, because older tutorials still recommend it.
Fees follow the outcome. Free solutions don't pay the review fee, per the ISVforce Guide. "There's no charge to resubmit a returned submission," while "there's a fee to retest a remediated solution," per AgentExchange Security Review Stages. A returned review means missing items, such as expired test org credentials. A failed one means real findings, a new package version and a new round. Check the current fee in the submission wizard, since the docs pages print no amount. Our security review checklist lists what to fix before you submit.
What a listing does for your sales team
The listing earns its keep late in a deal, not at the top of the funnel. When procurement asks whether your Salesforce integration is safe, a reviewed app the customer's admin can install answers it with Salesforce's name on the review, not yours. Installs are open to "Salesforce admins, Slack admins, and users with the Download AgentExchange Packages permission," per What Is AgentExchange?. Admins usually try a package in a sandbox first, through the listing's Try It option, because Get It Now "supports package installation in production environments only," per Installing Packages. A sandbox install guide belongs in the launch kit next to the listing.
Inbound demand is a separate question. Appnigma's marketplace apps page puts it plainly, "A listing supports discovery and evaluation, but it is not a promise of inbound leads." Salesforce's own partner benefits follow commercial milestones rather than the listing itself. In the ISV Track, the Select tier is for partners who "have listed paid application(s) on the AgentExchange." Newer benefits such as Lead Referral Incentives sit at the top tier, per the ISV Track overview. Plan co-sell as something you grow into after a paid listing ships, not a launch-day channel.
Billing is the other sales question. AgentExchange Checkout takes a 15% revenue share "plus a $0.30 per transaction fee charged by our payment partner, Stripe" on card payments, per Checkout revenue share. Checkout is open to partners "based in the United States, United Kingdom, or a European Union country." If you bill customers yourself, you report orders to Salesforce instead. Our post on the requirements to publish a paid AppExchange app compares the billing paths.
Mistakes that delay a first listing
- Building a package when an API listing would have met the buyer's need, or the reverse. The listing type can't be changed later.
- Starting the distribution agreement after the build. Salesforce wants it confirmed before you submit for review.
- Choosing a namespace in a hurry. It is permanent for the package and shows on every component.
- Leaving tests to the end. The 75% coverage rule blocks promotion, and only a promoted version can go to review.
- Copying
WITH SECURITY_ENFORCEDfrom an old tutorial. It isn't allowed in packages, and CRUD/FLS gaps are the top review failure. - Treating the listing as the launch plan. Install guides, a sandbox walkthrough and pricing need to be ready the day the listing goes live.
Build it yourself or bring in a partner?
The useful test is whether anyone on your team has shipped a managed package through security review before. If they have, keep it in house, because your engineers already know the packaging rules and can answer review findings in days. If nobody has, the risk to the launch sits in the permanent choices and in the review rounds, and each round costs weeks.
Appnigma's marketplace apps service is built for that second case. It promises "Your product, inside Salesforce or HubSpot," with a native app, listing preparation and review support from ex-Salesforce engineers. The page is plain about the limit, "Platform approval and queue timing are controlled by Salesforce or HubSpot," so no partner can shorten Salesforce's queue, only reduce the rounds. Its published Warmly project took two weeks to build and eight weeks from kickoff to launch. Six of those weeks were security review, and the page labels it "a project example, not a guaranteed schedule." If your integration should stay outside Salesforce, our done-for-you integrations team builds and maintains it instead.
Frequently Asked Questions
What is the Salesforce app marketplace called now?
AgentExchange. Since April 14, 2026 AppExchange, Slack Marketplace and the Agentforce agent marketplace have been one store. The old appexchange.salesforce.com address still opens it.
Can an API-only integration be listed on AppExchange?
Yes, as an API listing. It still needs a security review, but customers can't install it from the listing, and Checkout and the License Management App need a managed package.
How long does it take to get listed on the Salesforce marketplace?
Your build time plus approximately 4 to 6 weeks of security review on a first pass. Publishing after approval takes about 30 minutes.
What does it cost to list an app on AgentExchange?
Salesforce describes a revenue share rather than a joining fee. Paid apps pay a security review fee, free apps don't, and Salesforce takes a revenue share once you report revenue (15% plus card fees under Checkout).
Can Appnigma build and list our Salesforce app?
Yes. Appnigma's marketplace apps service covers the native app build, listing preparation and security review support. Salesforce controls the review queue itself.
About the author
Sunny Chauhan is the co-founder and CEO of Appnigma AI, which builds and maintains customer integrations and native Salesforce and HubSpot apps for B2B SaaS teams. Before Appnigma, he was on Salesforce's AppExchange team, where he worked with more than 300 SaaS partners. He has spent close to a decade on the Salesforce platform, including work at Zennify, and holds Salesforce certifications including Platform Developer II, Platform App Builder, Administrator, Data Cloud Consultant, and AI Associate.
Related Articles
- What Is Salesforce AgentExchange?
- How Long Does It Take to Get an App on the AppExchange?
- What Is a Managed Package in Salesforce?
- Requirements to Publish a Paid AppExchange App
- Salesforce Security Review Checklist
- How to Get Your App Listed on AgentExchange
- Is It Worth Listing Your SaaS on AppExchange?
Sources
- Salesforce, Introducing the new AgentExchange
- Salesforce Newsroom, AgentExchange announcement (March 4, 2025)
- Salesforce Newsroom, Headless 360 announcement
- Salesforce Developers, AgentExchange Install Guide, What Is AgentExchange?
- Salesforce Developers, AgentExchange Install Guide, Installing Packages
- Salesforce Developers, ISVforce Guide, Solution Types
- Salesforce Developers, ISVforce Guide, Select a Listing Type
- Salesforce Developers, ISVforce Guide, Installation Methods
- Salesforce Developers, ISVforce Guide, How the AgentExchange Security Review Works
- Salesforce Developers, ISVforce Guide, AgentExchange Security Review Stages
- Salesforce Developers, ISVforce Guide, Act on Security Review Results
- Salesforce Developers, ISVforce Guide, Submit Your Solution for Security Review
- Salesforce Developers, ISVforce Guide, Partner Business Org
- Salesforce Developers, ISVforce Guide, Use Managed Packages
- Salesforce Developers, Second-Generation Managed Packaging, Get Ready to Promote and Release
- Salesforce Developers, Second-Generation Managed Packaging, 2GP Workflow
- Salesforce Developers, Register a Namespace
- Salesforce Developers, Push Upgrades for Second-Generation Managed Packages
- Salesforce Developers, ISVforce Guide, Listing Builder Overview
- Salesforce Developers, ISVforce Guide, Get Your Listing Approved
- Salesforce Developers, ISVforce Guide, AgentExchange Checkout Overview
- Salesforce Developers, ISVforce Guide, Checkout Revenue Share
- Salesforce Developers, ISVforce Guide, Set Default Licensing
- Salesforce Developers Blog, The Top 20 Vulnerabilities Found in the AppExchange Security Review
- Salesforce Developers, Secure Coding Guide, Protect from CRUD/FLS Vulnerabilities
- Salesforce, Become an ISV Partner
- Salesforce, Become a Partner FAQ
- Salesforce, ISV Track Overview (PDF)
- Trailhead, Review Your Work and Publish
