# Listing your app

> Offer your app to every business on Facia. How review, installs, per-business secrets and turning off work.

# Listing your app

An app starts out **private** to the business that registered it. If it's useful to others, such as a game, a booking page or a loyalty tool, you can list it so any business on Facia can install it in a tap.

## Submit it

1. In **HQ → Settings → Apps**, open your app.
2. Under **Not listed**, press **Submit to Facia** ("Let other businesses install it, after a review").
3. Write **What it does, for other businesses**: one or two sentences, up to 500 characters.
4. It shows **Waiting for review**. Facia approves it, or turns it down with a reason you'll see in the same place.

Once approved, it shows **Listed on Facia**.

### What the review checks

- It follows the [rules](https://docs.facia.chat/build/overview#rules-for-every-app): no real-money payments in the frame, no collecting identity, no pretending to be Facia or support.
- It works on phones and in light and dark.
- It asks only for the permissions it uses.
- It works for any business: your server reads `biz` from the token and keeps each business's data apart.

## Installs

Other businesses find listed apps under **Install from Facia** in their **HQ → Settings → Apps**.

- Installing gives **that business its own secret**, kill switch and open counts, and (if your app posts) its own choice of groups.
- The page address, audience, places and permissions stay **yours**, the maker's.
- They send their secret to you, the maker, so your server can call the API for their business.

### One server, many businesses

Your server gets the token's `biz` and needs the right secret for that business, both to verify the token and to call the API.

```js
// biz → { appId, secret }: yours, plus one entry per business that installed your app.
const SECRETS = JSON.parse(process.env.FACIA_INSTALLS);

function verify(token) {
  const { biz } = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString()); // read, not trusted yet
  const install = SECRETS[biz];
  if (!install) throw new Error("unknown business");
  return { claims: jwt.verify(token, install.secret, { algorithms: ["HS256"], issuer: "facia", audience: install.appId }), install };
}
```

Store installs in a database rather than an environment variable once you have more than a few.

## Uninstalls and turning off

- A business can **Uninstall** at any time. Its secret dies, and its tab disappears.
- **Deleting your app** removes every install.
- Facia can **turn an app off everywhere** (shown as **Turned off by Facia**, with a reason). The tab and every call stop at once, nobody can install it, and the maker can't switch it back on.