I looked at how 12 of our customers shipped on AppExchange in the last 18 months. The pattern is consistent: their first enterprise deal stalled at procurement until the prospect could find them on AppExchange. The second deal paid back the entire investment. This guide is the full process, the 12-month total cost line by line, the requirements Salesforce actually checks for, and the no-code path that lets you skip the $80,000 to $300,000 PDO contract.

Pro Tip

TL;DR: Listing on Salesforce AppExchange takes 5 to 9 months end-to-end and costs $25,000 to $300,000 in development, plus a $999 security review fee per paid-app submission, a $150 annual listing renewal, and a 15% revenue share (25% for OEM) on every dollar Salesforce customers spend. The 2026 program follows a 6-stage lifecycle (Plan, Build, Distribute, Market, Sell, Support), and as of May 11, 2026, every AppExchange Connected App must meet the new mandatory security controls. With 91% of the 150,000+ Salesforce customers using at least one AppExchange app and 6,233 apps already listed, the marketplace is the procurement gate most enterprise deals depend on. The second enterprise deal usually pays for the entire listing investment.

The Salesforce AppExchange is Salesforce's official enterprise software marketplace where ISVs distribute managed packages to the 150,000+ companies that run Salesforce. It hosts 6,233 apps from 3,668 unique developers as of December 2025. 91% of Salesforce customers use at least one AppExchange app, which is why most enterprise procurement teams gate on AppExchange presence before signing.

Pro Tip

Citation capsule: Counts and ecosystem stats from SFApps.info State of AppExchange 2026. Customer base size from Salesforce corporate materials.

Salesforce defines a 6-stage product lifecycle: Plan, Build, Distribute, Market, Sell, Support. Stages 1 to 3 cover everything from signing up as a partner to getting your listing live. Stages 4 to 6 cover the ongoing work of selling and supporting your app.

Source: Trailhead, AppExchange Product Lifecycle module.

The Salesforce fees are small. The dominant cost is engineering. Here's the 12-month total cost of ownership broken into line items, modeled for a typical B2B SaaS company shipping a mid-complexity managed package.

Cost ranges from Noltic's AppExchange cost breakdown, Magicfuse pricing analysis, and Salesforce ISVforce Guide.

Realistic end-to-end timeline: 5 to 9 months for a first-time listing. The dev work dominates. The security review is the second-biggest block. Roughly half of first-time security review submissions fail, adding 2 to 3 weeks per resubmission.

Salesforce will not let you submit until every item below is in place. Most first-time failures come from missing or weak versions of items 4, 5, and 8.

1. Partner Business Org (PBO) provisioned and in active status.

2. 2GP managed package (recommended over 1GP) installable from a release version.

3. Signed Partner Distribution Agreement (PADA).

4. Solution Architecture Document uploaded to the Partner Security Portal. Data flows, integration surface, sharing model, external endpoints.

5. Source code scanner output from sfdx-scanner (Chimera was retired June 16, 2025). Plus a DAST report from OWASP ZAP, Burp Suite, or Qualys.

6. Test org with credentials pre-loaded with realistic data, login steps documented.

7. Listing copy: title, tagline, full description, key features list, category tags.

8. Marketing assets: logo, screenshots, demo video under 3 minutes (ideally around 1 minute, HD).

9. Pricing definition with AppExchange Checkout configured or external billing documented.

10. Support process and contact URLs.

11. Security review fee paid ($999 for paid apps, $0 to $1 for free apps).

Pro Tip

Companion read: Our deep dives on the AppExchange security review and the security review checklist go line by line through what reviewers look for.

ISVforce partners pay Salesforce 15% of net subscription revenue. OEM partners pay 25%. Both drop after $20 million cumulative revenue.

If you use AppExchange Checkout for credit-card processing, Salesforce adds a $0.30 Stripe transaction fee per charge on top of the 15% revenue share. If you bill off-platform (invoicing the customer directly with your own billing stack), you skip the Stripe fee but still owe the 15% report-and-remit. Most enterprise SaaS companies choose off-platform billing because their customers prefer invoice payment terms.

Pro Tip

Citation: Revenue share percentages from Salesforce Developer Docs, AppExchange Checkout Revenue Share. $20M marginal royalty bands per Magicfuse Partner Agreement analysis.

The build process is where 80% of the time and 90% of the cost goes. There are three viable paths.

Whichever path you pick, the technical output must be the same: a 2GP managed package that follows Salesforce's secure coding standards, installs cleanly into a customer's org, exposes the right metadata for AppExchange listing, and passes Checkmarx and Salesforce Code Analyzer scans.

The clearest answer comes from the math: at typical B2B enterprise ACV, the second deal pays for the entire listing.

• Your ICP is enterprise or mid-market on Salesforce. Deals routinely stall at "is it on AppExchange?"

• Procurement-led buying, with security and vendor review parity required.

• Average ACV above $25,000. Two deals at $50,000 ACV with 3-year LTV pays back $300,000.

• You're already paying the Salesforce tax: integrations, consulting hours, support tickets routed through SF.

• SMB-only target. ACV under $5,000.

• No structural Salesforce dependency in your customer's workflow.

• Product is a thin wrapper that competes with native Salesforce features.

• Team has zero Salesforce knowledge and no budget for a PDO.

Yes. AI-native platforms generate the managed package, the Solution Architecture Document, and the security review artifacts from natural language prompts. The output is code that follows Salesforce's secure coding standards from the start, which is why it clears Checkmarx and Salesforce Code Analyzer on the first pass.

At Appnigma AI, every generated managed package includes:

• 'with sharing' declared on every Apex class touching user data

• WITH SECURITY_ENFORCED on every SOQL query, or Security.stripInaccessible when dynamic

• Bind variables in every dynamic query, no string concatenation

• Output encoding applied in Visualforce and template binding in LWC

• Named Credentials for every external endpoint, no hardcoded secrets

• Solution Architecture Document and DAST report templates pre-filled from the package metadata

The companies shipping on AppExchange this way: Warmly, Hyperbound, Pylon, Avoma, UserEvidence, Aline, Alguna, Salesbricks, and Seam AI. None of them hired a Salesforce dev team.

Pro Tip

Generate an AppExchange-ready managed package in 60 seconds. Type a prompt. Get a 2GP managed package that clears security review on the first scan. Book a demo.

Three structural changes between 2023 and May 2026 broke most older AppExchange listing guides.

Pro Tip

The May 11, 2026 deadline just hit. If your AppExchange app uses Connected Apps for OAuth or External Client Apps for callouts, you must have the new security controls in place by now. Apps without compliant configuration risk being delisted. The Spring '26 ISVforce Guide v66.0 published April 30, 2026 documents the exact requirements. Aquiva Labs deep dive.

Salesforce defines a six-stage product lifecycle: Plan, Build, Distribute, Market, Sell, Support. In practical terms: join the Partner Community at partners.salesforce.com, get a Partner Business Org, build your app as a 2GP managed package, sign the Partner Distribution Agreement, submit for security review with the $999 fee, and after passing, create your listing in the AppExchange Partner Console. End-to-end, expect 5 to 9 months for a first-time launch.

Partner Community signup is free. The security review costs $999 per submission for paid apps. The annual listing renewal is $150. Salesforce takes a 15% revenue share on net subscription revenue (or 25% for OEM). Development cost ranges from $25,000 to $150,000 with a traditional Salesforce dev shop, or $100,000 to $300,000 for complex enterprise vertical apps.

Realistic end-to-end timeline is 5 to 9 months for a first listing. Partner Community signup takes 1 to 2 weeks. Partner Business Org provisioning takes 1 to 3 business days. Development takes 8 to 20 weeks. Pre-submission validation takes 1 to 2 weeks. The security review takes 4 to 8 weeks for an initial pass. Roughly half of first-time submissions fail, adding 2 to 3 weeks per resubmission.

ISVforce partners pay Salesforce 15% of net subscription revenue (10% above $20 million cumulative). OEM partners pay 25% (15% above $20 million). If you use AppExchange Checkout for credit-card billing, add a $0.30 Stripe transaction fee per charge. Free apps incur no revenue share. Off-platform billing is still subject to the 15% report-and-remit obligation unless contractually exempt.

A Partner Business Org, a 2GP managed package, a Solution Architecture Document, a demo video under 3 minutes, screenshots and logo, listing copy, pricing definition, support process and URLs, test org credentials for the security review team, source code scanner output, and a passing security review. Paid apps also require the $999 review fee.

If your target buyer is an enterprise or mid-market company that uses Salesforce, and your deals are routinely blocked by 'is it on AppExchange?', listing is worth it. The second deal pays for the listing at typical ACV. If your ICP is SMB with sub-$5K ACV, or your product has no structural Salesforce dependency, skip it. 91% of Salesforce customers use at least one AppExchange app.

Yes. AI-native managed-package generators like Appnigma produce 2GP managed packages, secure Apex, Solution Architecture Documents, and DAST report templates from natural language prompts. Customers including Warmly, Hyperbound, Pylon, Avoma, UserEvidence, Aline, Alguna, Salesbricks, and Seam AI listed on AppExchange without hiring a Salesforce engineering team.

Two structural changes hit in 2025 to 2026. First, mandatory Connected App and External Client App security controls became required on May 11, 2026. Second, the Chimera DAST scanner was retired on June 16, 2025. The Spring '26 ISVforce Guide v66.0 (April 30, 2026) is the canonical current spec.

This pillar is the hub. The deep dives:

• The 2026 Salesforce ISV Partner Program guide. Tiers, costs, ISV vs OEM, and the path to becoming an ISV.

• The 2026 Salesforce security review guide. Fees, timeline, what they check, and the top 10 failure causes with code-level fixes.

• The 2026 managed package guide. What you're submitting for security review and how the packaging model works.

• How to build a managed package without code. The no-code path Appnigma's customers take.

• Salesforce Partner Business Org explained. The org where you'll build everything.

• Appnigma for AppExchange. How AI-generated managed packages cut your time-to-listing.

• SFApps.info, State of AppExchange App Analytics 2026

• Salesforce, 10 Million AppExchange Installs

• Trailhead, AppExchange Product Lifecycle

• Salesforce ISVforce Guide, Create Your AppExchange Listing

• Salesforce ISVforce Guide, AppExchange Checkout Revenue Share

• Salesforce ISVforce Guide v66.0 Spring '26 PDF (April 30, 2026)

• IDC (2023), AI-Powered Salesforce Economy: 11.6M jobs, $2.02T by 2028

• Noltic, How Much Does It Cost to Build an AppExchange App

• Magicfuse, AppExchange Pricing and Monetisation

• Aquiva Labs, Mandatory Connected App Security Requirements (May 11, 2026 deadline)

• Beyond The Cloud, AppExchange Publication Checklist