I’m a registered Development Partner running a public app (OAuth 2.0, type
External Integration) that I keep unlisted — clients connect via the
standard OAuth flow rather than through the Add-on Store. It’s live against one
production account and working well. Before connecting further client accounts
I’d like to confirm four things so I build this correctly:
Connection cap — is there any limit on how many separate ServiceM8
accounts an unlisted public app can be authorised against at once? Does a
Store listing change that?
Rate-limit scope — the docs state 180 requests/min and 20,000/day. Can
you confirm these apply per connected account, rather than as one global
quota shared across all accounts the app connects to?
Commercial use while unlisted — is operating a single unlisted public
app as a paid, managed service across multiple clients’ accounts (each
granting their own OAuth consent) within the Partner Agreement? If this is
better handled off-forum, who’s the right contact to confirm it formally?
Consent-screen warning — the OAuth consent screen for an unreviewed app
warns users the app is unofficial and to proceed only if they trust the
developer. Is there a path to have an app reviewed/approved so the warning
is removed without publicly listing it on the Add-on Store? My onboarding
is deliberately high-touch (I connect each client personally) — I’m not
after self-serve installs, just a consent screen that doesn’t undermine
client trust.
I can share my App ID privately if useful. Thanks!
Short version: an OAuth 2.0 Public Application can be created and used without making it publicly available in the Add-on Store, and the documented API throttling limits are applied per application/account pairing.
Connection cap: the public developer docs confirm you can create a Public Application and choose not to list it on the ServiceM8 Add-on Store, but we don’t have a public documented connection cap for unlisted public apps, or a documented difference in cap based on Store listing. We should confirm any app-specific limits privately.
Rate-limit scope: yes, the documented limits are 180 requests/minute and 20,000 requests/day, and they’re applied per application/account pairing. That means if a single application is connected to two different clients’ ServiceM8 accounts, throttling is applied separately to each account.
Commercial use while unlisted: the public docs say a Public Application does not have to be made publicly available, and the Add-on Store docs say developers can either use ServiceM8 billing or manage charging directly for add-ons. Formal interpretation of the Partner Agreement, or approval of a specific paid managed-service model, isn’t something we can confirm on the public forum.
Consent-screen warning: the documented review process is the Add-on Store review flow, where the add-on is submitted, assessed, approved for Partner Preview or rejected with feedback, then released publicly if no issues arise. We don’t have public documentation confirming a permanent approved-but-never-publicly-listed path for removing the unreviewed-app consent warning.
For the connection-cap, commercial, and approved-but-unlisted consent-screen questions, email support@servicem8.com with your App ID so we can route it to the right developer review channel.