PPlatformAppStores

Duda App Store

Ecommerce

Duda · Ecommerce & storefront platforms

Best for: SaaS vendors, web agencies, and service providers that need to embed configurable third-party functionality across multiple Duda sites, with optional API, webhook, ecommerce, or editor integration.

Overview

The Duda App Store is a marketplace for third-party integrations that run within the Duda website-building ecosystem. Developers can publish Apps that provide configurable in-editor functionality across Duda sites, including contact forms, chatbots, accessibility, SEO, marketing, booking, analytics, customer support, and connections to external services such as HubSpot, Salesforce, Mailchimp, and Google Sheets. Apps can use Duda APIs and webhooks through manifest-defined scopes, present installation permissions for user confirmation, load their interface in a Duda iframe using Duda SSO, and offer free, trial, or paid plans.

How to build & ship

  1. 1Determine whether the functionality needs installation on sites outside the provider’s account or an in-editor user interface; otherwise use the corresponding Partner API endpoints.
  2. 2Create the App manifest with the base SSO URL, public key, plan configuration, and required scopes or webhook events.
  3. 3Implement the embedded iframe UI and Duda SSO verification, including timestamp validation and third-party cookie flags.
  4. 4Implement the required Duda API operations and webhooks while requesting only the scopes needed by the App.
  5. 5Configure at least one free, trial, or paid plan and complete Duda’s App onboarding and listing process.

Key APIs & SDKs

Duda Partner API / site REST API
App manifest and App scopes
App Store webhooks
App SSO
Iframe SDK

Integration types

Embedded app
Connector
Workflow action
Bot
Extension

Authentication & security

  • Primary auth: Duda App SSO using a signed secure_sig parameter verified with the public key in the App manifest
  • Also supports: Duda API access authorized through manifest-defined App scopes
  • Security review: Not publicly specified
  • Functioning Apps require SSO signature verification, rejection of SSO links older than 120 seconds, and SameSite=None plus Partitioned authentication cookies in the App Store iframe context; a formal marketplace review checklist or approval SLA is not publicly specified.
  • Not publicly specified; official documentation specifies Duda-side setup for App scopes and some plan or contract changes, while users confirm requested scopes during installation.
  • Not publicly specified
Auth docs Store policies

Monetization

Free
Paid app
Onboarding
Not publicly specified
Commission
Not publicly specified
Merchant of Record
Not publicly specified

Pros & cons for builders

Pros

  • Apps can be installed on sites outside the provider’s own account.
  • Apps provide an in-editor interface for configuring third-party functionality.
  • The platform exposes broad site, ecommerce, content, webhook, and editor surfaces.

Cons

  • Duda controls initial scope assignment.
  • Duda controls plan pricing and structural plan changes.
  • Embedded Apps require special SSO, timestamp, and third-party-cookie handling.

Frequently asked questions

How do I get my app approved on Duda App Store?

Not publicly specified; official documentation specifies Duda-side setup for App scopes and some plan or contract changes, while users confirm requested scopes during installation.

What authentication does Duda App Store use?

Duda App Store apps primarily authenticate with Duda App SSO using a signed secure_sig parameter verified with the public key in the App manifest, also supporting Duda API access authorized through manifest-defined App scopes.

How is Duda App Store monetized?

Duda App Store supports Free, Paid app. Typical commission: Not publicly specified. Onboarding fee: Not publicly specified.

Is a security review required to list on Duda App Store?

Duda App Store's public materials do not specify a universal security-review requirement. Functioning Apps require SSO signature verification, rejection of SSO links older than 120 seconds, and SameSite=None plus Partitioned authentication cookies in the App Store iframe context; a formal marketplace review checklist or approval SLA is not publicly specified.