What Is a Marketplace App
A Flowlu Marketplace app is a modular add-on that extends the platform through documented integration points. Apps are installed into Flowlu but run independently from the core system, and each one follows a standard structure that both Flowlu and developers understand.
At a basic level, an app is a package that includes a description (the manifest), executable code or links to an external service, and interface resources such as widgets, icons, or UI templates.
App formats
Marketplace apps can be built in two main formats.
Embedded web module
An embedded web module is made of frontend components that integrate into the Flowlu interface at predefined integration points. These modules run in the user's browser, use Flowlu's SDK, and appear as part of the Flowlu interface. They have no direct access to Flowlu's internal logic or data, and interact with the platform only through approved APIs.
External service
An external service is a standalone web app hosted by the developer and integrated with Flowlu through APIs and an iframe. Its interface is displayed inside a secure iframe or opened in a new window. All interaction with Flowlu happens through authenticated API requests, following the platform's security and permission policies.
App structure
Each app package includes the following components.
Manifest
The manifest defines the app's metadata, required permissions, and integration points within Flowlu. It's the central configuration file for the app, and it's described in more detail in later sections.
Frontend
The frontend includes the interface files (HTML, CSS, JavaScript) or a compiled bundle that renders the app's UI inside Flowlu. It can be dynamic, and may use schema-based form generation.
Backend
The backend holds the app's server-side logic. If server-side processing is needed, the app can call external APIs, use cloud functions, or interact with the developer's own server. All communication with Flowlu goes through the public API, with token validation and permission checks enforced on every request.
Assets and static resources
These are the supporting materials an app needs to run: icons, localization files, templates, styles, and other static resources. They can be stored inside the app package or loaded from external URLs specified in the manifest.
Isolation and interaction with the core platform
All apps run in isolation from the Flowlu core. An error in an app's code must not affect the stability of the main platform. To enforce this, apps run in a sandboxed environment with no direct access to Flowlu's internal pages or scripts. An app embedded in the Flowlu UI, for example, is loaded in an iframe from a separate domain, so its scripts can't interact directly with the main page.
Apps cannot reach Flowlu's database or internal core methods. All interaction happens through official APIs and documented integration interfaces. Every API request must be authorized with valid credentials, permission checks run on each request, and any call to a method outside the app's assigned permissions is blocked automatically.
This approach lets developers extend Flowlu through approved integration points while keeping the core platform secure and stable.
For endpoint references, authentication details, and request examples, see the Flowlu API documentation.
