Going live and app review

There is no approval queue: an app can be connected by any HassleFreeBooks customer the moment you register it. What keeps that safe is an automated reviewer — and a few things you do before real customers arrive.

Before customers connect

  • Fill in the public details: website, privacy policy, terms, support email. Customers see them on the consent screen and on their Connected apps page.
  • Ask for the least access you need. Read-only apps should register only read.
  • Keep secrets on servers. Mobile, desktop and browser apps are public clients with PKCE and no secret.
  • Store tokens encrypted, keyed by the entity_id the token response names, and save the new refresh token on every refresh.
  • Handle disconnection: a 401 after a failed refresh means the customer (or their business owner) disconnected you. Show "Reconnect HassleFreeBooks", and delete their data when they ask.
  • Watch for Deprecation headers and read the changelog.
  • Use your test business for development and automated tests, never a customer's.

How the automated review works

When you save an app, its name, description, website and redirect URIs are screened — by rules that look for what phishing apps do (using our name or a bank's, link shorteners, bare IP addresses, "verify your account" language) and by an AI reviewer that reads the listing the way a customer would. Almost every app passes and nothing happens. An app that looks risky is held for review: it keeps working for you, so you can keep building, but other businesses cannot connect it until a person has looked. Editing the listing to fix what was flagged re-screens it straight away.

Every hour, each active app's usage is measured: refused calls (probing businesses or scopes it was not given), tokens being replayed, failed client authentication, customers disconnecting in numbers, sudden floods of traffic. Crossing a line gets a second opinion from the AI reviewer. Most findings are only flagged for a person to look at. Only a severe signal the reviewer agrees with pauses the app automatically: its tokens are refused until it is reinstated, but no customer is disconnected — everything resumes if it was a false alarm. Failed client authentication on its own (someone trying secrets against your public client id) is only flagged, never a pause, and an app a person has reinstated is not paused again over the usage they already looked at.

Either way you get the reason on your app's page and a Request a review button. A person reviews every pause, and we email you when we decide.

Limits

  • Up to 25 apps per developer account.
  • Up to 10 redirect URIs per app.
  • The API's normal rate limits apply to every app.

Saying you work with us

"Works with HassleFreeBooks" or "Connects to HassleFreeBooks" is fine. Our name or logo in your app's name, domain or icon is not. See the Developer Terms.