Getting started

1. Create an app

Open Developer Console, choose the closest install target and copy the one-time client secret. Jotify stores only its hash.

• Keep the app private while developing.
• Use HTTPS for every production callback and embedded URL.
• Never put a client secret in browser or mobile code.
• Use Jotify CLI to create, validate, preview and package the manifest.

2. Exchange an install session

Embedded apps receive a short-lived bootstrap value in the URL fragment. Exchange it once, cache the bounded context for the tab and remove the fragment.

import { exchangeJotifyInstallSession, requireJotifyScope } from '@jotify/app-sdk';

const context = await exchangeJotifyInstallSession();
requireJotifyScope(context, 'site:read');

3. Upload an immutable candidate

Run the CLI pack and deploy commands. Deploy uploads a draft candidate with a verified bundle digest; it never bypasses App Review or activates public distribution.

jotify app validate
jotify app dev
jotify app pack
JOTIFY_CLIENT_ID=... JOTIFY_CLIENT_SECRET=... jotify app deploy dist/my-app-0.1.0.jotifyapp

4. Submit for review

Declare URLs, scopes, surfaces, privacy terms and a changelog. Review is attached to that exact version; changing approved metadata returns the app to draft.

• Development install
• Automated security checks
• Human review where required
• Private or public distribution decision