Cam Stuart

Thanks Shawna James !

Hello Everyone,

I have built several Zendesk apps now, both client side and server side.

And so far the developer experience hasn't been great. Some of the main challenges I have solved:
 

• Authentication with server side apps, especially those going into the marketplace
• Hot reload / fast feedback while developing within my Zendesk dev instance
• Automated building an app bundle for upload/submission 
• Recent tech (eg React version)
   

The zcli tool generates a fairly old React app, with several no longer used technologies. 

So I set about solving these problems for myself, but I wondered if a starter kit would be useful to anyone else? 

I am not sure how many organisations build their own apps vs saas builders building for the marketplace, making hard to get a sense of how many people might be interested.

So I would love to know if this is something you might find useful, what other features would you want? what tech stacks / tools do you prefer, and how much you think something like this would be worth?

Thanks! 

Hi Tipene,

I wouldn't describe it as a solution, more of a workaround. And not especially secure.

In my case I have a server side top bar app defined in the manifest, and I also have a background app as well.

So because the background app has access to Zaf, I determine the app id dynamically, construct a request to get the public key, and send it to my backend via a POST request with the public key and subdomain in the body. This effectively “onboards the organisation ” with an upsert operation in my database.

Then when my server side app is opened, and a JWT sent as part of the initial post request, I am able to verify it, create a session and away we go. 

But unfortunately this has some security concerns, and if I build future server side apps that don't require the background app, then I would have to add one anyway.

I'm hoping you can make another suggestion!

I have managed to get this working using the method described above, but what I can't figure out is how I can get the public key dynamically for a subdomain that has purchased my app. In their case, I won't have email/token that can get the public key in their account.

Usually, public keys are not auth protected because they are, well, public.

What is the recommended solution here for app marketplace developers?