AppExchange
AppExchange is the marketplace Salesforce operates for third-party applications, components, consultants, and Trailhead-style learning content that extend the Salesforce platform.
Definition
AppExchange is the marketplace Salesforce operates for third-party applications, components, consultants, and Trailhead-style learning content that extend the Salesforce platform. It launched in 2005 and is now the largest enterprise-application marketplace by listing count, with over 4,000 apps spanning Sales Cloud, Service Cloud, Marketing Cloud, vertical clouds, and Slack. Apps install directly into a Salesforce org through one-click flows, with the metadata, code, and license terms handled by Salesforce as the package broker.
AppExchange is more than a download site. It is the distribution and revenue channel for Salesforce's ISV ecosystem. ISVs (Independent Software Vendors) publish managed packages on AppExchange, sign Partner Program contracts with Salesforce, pay a share of license revenue back to Salesforce, and submit each release to a Security Review that gates publication. Customers benefit from this gate: AppExchange listings have been audited for OWASP-class vulnerabilities, sharing-rule abuse, and platform-API misuse. The same code outside AppExchange has no such guarantee.
How AppExchange works as the Salesforce platform marketplace
How AppExchange listings actually work
Each AppExchange listing is backed by a managed package in the ISV's packaging org. When a customer clicks Install, AppExchange routes them to a Salesforce-hosted installation flow, the customer picks their target org, accepts the license terms, and the platform pushes the package metadata into the target org through the Tooling and Metadata APIs. The listing page is the marketing surface: screenshots, demo videos, customer reviews, pricing tiers. The package is the technical artifact. Updates flow through the same channel: an ISV pushes a new version, the listing updates, customers see an Update button in their Installed Packages screen.
The Security Review gate
Every listing on AppExchange has passed a Security Review at least once. The review is a manual audit by Salesforce's Product Security team that checks the package against the OWASP Top 10, Salesforce-specific patterns (with sharing on Apex classes, FLS enforcement in SOQL, escape sequences in Visualforce), and the AppExchange Partner Program technical requirements. Initial reviews take 4 to 8 weeks. Subsequent reviews for new package versions take 2 to 4 weeks. The review is the single biggest reason AppExchange apps cost more to build than equivalent unmanaged code. It is also the reason customers can trust the apps without auditing every line themselves.
Listing types: app, component, bolt, lightning data, consultant
AppExchange supports five listing types. Apps are full applications, typically managed packages. Components are reusable UI elements: a Lightning component or a Flow action. Bolts are pre-built Lightning Experience-on-a-page solutions, usually Experience Cloud templates with sample data. Lightning Data is the data-enrichment marketplace, with providers like Dun & Bradstreet and Lattice Engines selling subscription enrichment. Consultant listings are Salesforce SI partners (Accenture, Deloitte, Slalom, smaller boutiques) marketing implementation services rather than software. The five types share the listing UI but route through different Partner Program tracks.
Pricing models on AppExchange
ISVs pick from several pricing models when publishing. Free listings (the app is free, the ISV does not charge for license). Paid one-time (the customer pays once, gets perpetual access). Paid subscription (the customer pays per user per month, the standard SaaS model). Freemium (free tier with paid upgrade). Salesforce takes 15 to 25 percent of paid-license revenue depending on the partner tier. Customers see pricing on the listing page and the actual transaction (license issuance, billing, renewal) routes through Salesforce or through the ISV's own billing system depending on the model.
Installation modes: admins only, all users, custom profiles
When installing an AppExchange package, the customer picks one of three modes. Admins Only grants access to the package only to System Administrator profiles. All Users grants access to every user in the org. Specific Profiles lets the admin pick which profiles get access on a per-package basis. The default is Admins Only, which is right for utilities and dangerous for end-user-facing apps. Picking the wrong mode is the most common reason a freshly installed app appears to not work: the package installed cleanly, but the relevant profiles have no permission to launch it.
Trial orgs, demo orgs, and the Try It Free button
Many AppExchange listings have a Try It Free button that provisions a free Salesforce trial org with the app pre-installed and sample data loaded. The trial org lasts 14 to 30 days depending on the package. It is intentionally disposable: the customer evaluates the app, decides whether to buy, and the org expires. ISVs use the trial flow as a top-of-funnel lead generator. Customers use it to validate fit without polluting their real sandboxes. The Try It Free experience is built on the AppExchange-managed Trial Force orgs and the package's Trial Definition.
Reviews, ratings, and the AppExchange Trust signal
Every listing carries reviews and a star rating, written by real Salesforce customers. The reviews are moderated by Salesforce but mostly user-driven. A 4-star or higher app with 100+ reviews is the strongest social signal an AppExchange listing can have, and it is one of the first things experienced buyers check. Newer apps with fewer reviews require deeper evaluation: read the security review badge, check the listing's last update date, look at the AppExchange partner tier (Premier, Summit, Crest). Listing freshness matters. An app last updated three years ago on a 2022 release is almost certainly a maintenance-mode product.
Installing an AppExchange app safely
Installing an AppExchange app is straightforward when you know the steps. Skipping any step is the most common source of "the app installed but nothing works" complaints.
- Find the listing on appexchange.salesforce.com
Search by app name, browse by category, or follow a link from a peer recommendation. Check the security review badge, last update date, and review count before clicking Get It Now.
- Click Get It Now and pick your org
The flow asks which org to install into: production or sandbox. Always install in sandbox first. Production-first installs of an unfamiliar app are how orgs end up with hundreds of unwanted custom fields.
- Confirm the install profile mode
The install wizard asks: Admins Only, All Users, or Specific Profiles. Default to Admins Only for a test install, then re-evaluate after you verify the app's behavior.
- Accept the license terms and approve the install
Read the licensing terms even when they look standard. Approve the third-party access prompts (Apex callouts, remote site settings). The install runs in 1 to 5 minutes for most packages.
- Open Installed Packages in Setup
Verify the package appears, note the namespace prefix, and check the Manage Licenses link. Many AppExchange apps require per-user license assignment in addition to profile permission.
- Configure the app per the vendor's setup guide
Almost every AppExchange app has post-install configuration: API keys, remote site settings, page layout updates, permission set assignments. Read the vendor docs and run through them before declaring the app installed.
Admins Only, All Users, or Specific Profiles. Admins Only is the safe default for an unknown app. Specific Profiles is right for end-user apps.
The install wizard asks which org to target. Sandbox-first is the universal best practice. Production-first installs of unfamiliar apps cause incidents.
Every managed package brings a namespace (vendor__). Components from the package appear with this prefix, distinguishing them from your custom metadata.
Per-user license assignment, separate from Salesforce user licenses. Managed in Setup, Installed Packages, Manage Licenses on the package row.
The endpoint whitelist that allows Apex callouts from the package. Most packages auto-add their endpoints during install; some require manual configuration.
- Installing in production first is the fast way to regret. Always install in sandbox, validate, then deploy through the same managed-package mechanism in production.
- Apps under Security Review are not the same as approved apps. Look for the Security Review Approved badge on the listing. Without it, the app may have functional gaps or known issues.
- Managed packages cannot be customized after install. Adding fields, modifying triggers, or changing layouts inside the namespace is blocked. Plan around the package's extension points before committing.
- Some apps require per-user license keys provided by the vendor. License assignment is separate from profile-based access. Both need to be in place for the app to work for end users.
- Uninstalling a managed package removes the metadata but not the data records. Custom object data created by the app survives uninstall unless the admin explicitly deletes it through Data Loader first.
Trust & references
Straight from the source - Salesforce's reference material on AppExchange.
- Salesforce AppExchangeSalesforce
- Install a PackageSalesforce Help
About the Author
Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He runs salesforcedictionary.com to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.
Test your knowledge
Q1. Who can benefit from understanding AppExchange?
Q2. How does Salesforce's multi-tenant model affect AppExchange?
Q3. What architecture concept is AppExchange an example of?
Discussion
Loading discussion…