Administration
Register a source, sync it, grant it to organizations, and decide who can use each app.
Two roles are involved in getting an app to users:
- A global admin manages sources for the whole platform: registers them, syncs them, and grants them to organizations.
- An organization admin decides who in their organization can use each app, and approves the scopes and network origins it asks for.
Global admin is a platform-level role, separate from organization roles. On a
self-hosted installation the operator designates the first global admin when
deploying the identity service (BOOTSTRAP_ADMIN_EMAIL).
Register a source
As a global admin, open Settings → Global → App sources and choose Add source.
| Field | Meaning |
|---|---|
| Name | Label shown in the source list. |
| Type | S3 bucket. GitHub is listed as "Coming soon". |
| Bucket | Bucket name. Leave empty to read from the platform's own storage. |
| S3 prefix | Folder the app folders live under, e.g. apps. Required. |
| Endpoint URL / Region | Only for an external bucket. The endpoint must be https:// on a public host. |
| Access key ID / Secret | Only for an external bucket. Needs list and read access; stored encrypted. |
Test connection checks the settings without saving and reports how many manifests it sees under the prefix. Create source saves the source; it does not sync it.
See Publishing for the bucket layout and the limits that apply.
Sync it
A new source shows Never synced. Open the source's ⋮ menu and choose Sync now. The result is reported as a notification:
- Synced n app(s). — everything under the prefix was valid.
- Synced n app(s); m skipped as invalid. — some manifests failed validation. The interface does not say which or why; ask the app's developer to check the manifest.
Sync again whenever a developer has uploaded a change — S3 sources are never synced automatically. The same menu offers Test connection and Delete. Deleting a source removes all of its apps from the platform.
Grant it to organizations
A synced source is hidden from every organization. Choose Manage access on the source, then Add next to each organization that should receive its apps.
For every app you can pin the version an organization runs: Latest follows each sync, a specific version stays fixed until you change it. Removing an organization revokes its access to all apps of the source.
Availability and consent
Once a source is granted, its apps appear for the organization's admins under Marketplace → Apps, marked Not available. The organization admin opens the app's Manage availability control to decide who can use it:
- Only chosen people — hidden from the organization; granted to selected users. This is the default.
- Available to install — members see the app and can install it themselves.
- Installed for everyone — installed for the whole organization.
- Public — usable by anyone, without installing.
The same panel is where the admin approves scopes beyond workspace:own and
store:own (for example documents:read or responses:run) and the
connectOrigins the app wants
to reach. Until a requested scope or origin is approved, calls that need it are
rejected.
Installed apps open from Marketplace → Apps → Open, at /apps/<slug>.