Developer Docs.

SecureBin Developer Platform

Build apps for SecureBin with HTML, CSS, and JavaScript. The public SDK includes a local development server, a neutral starter app, the SecureBin runtime bridge, manifest validation, and the marketplace submission tools required to prepare an app for review.

Marketplace submissions

Create a reviewable .sbapp-review.json submission from your project when your app is ready for SecureBin App Store review.

Signed releases

Approved submissions are converted by SecureBin into signed marketplace packages. Developers do not need the SecureBin publisher key.

Web-native development

Use familiar browser technologies and the included runtime bridge to integrate supported SecureBin capabilities.

Starter example included

The public SDK contains a neutral Hello SecureBin example. No SecureBin first-party application source or private publisher keys are included.

Publisher security. The public SDK does not include SecureBin's marketplace publisher private key. Marketplace signing is performed only after an app is approved for publication.

Overview

A SecureBin app is a local project containing a manifest and a source directory. You develop and test the app locally, then use securebin submit to create the review file submitted to the SecureBin App Store.

Quick Start

Extract the SDK, open PowerShell or a terminal in the SDK folder, and create a project:

node .\bin\securebin.js create my-app
cd .\my-app
node ..\bin\securebin.js dev

Edit src/index.html, src/app.js, and securebin.app.json. Refresh the local preview as you work. When the app is ready for marketplace review, stop the development server and run:

node ..\bin\securebin.js submit --out dist\my-app.sbapp-review.json

Upload the generated .sbapp-review.json file on the Upload App page together with your App Store listing information.

Project Structure

The starter project contains no package key, publisher key, installable .sbapp, or SecureBin first-party application. If you generate optional developer signing keys, keep the private key out of source control and do not include it with your submission.

Manifest

Every app includes securebin.app.json. The SDK validates this file before development and submission.

{
  "id": "com.example.my-app",
  "name": "My App",
  "version": "1.0.0",
  "source": "src",
  "entry": "index.html",
  "permissions": []
}

Package ID and App Store slug are separate. Keep the manifest id stable across releases. Your App Store listing can use a separate human-readable slug.

Permissions

Declare only the capabilities your app requires. Unsupported permissions fail manifest validation.

Permissions declared in the manifest should match the functionality described in your App Store listing. Request the minimum capabilities required for your app to operate.

Runtime API

The SDK includes runtime/securebin-runtime.js, which exposes window.securebinSDK when the app is running with a compatible SecureBin host. During local development, include the runtime bridge served by the SDK:

<script src="/securebin-runtime.js" defer></script>
<script src="app.js" defer></script>

Runtime calls can fail when a capability is unavailable, not declared, or not granted. Handle rejected promises and provide a clear fallback state in your interface.

Messaging apps

Apps that declare crypto.signal can use the SecureBin Signal bridge exposed at securebinSDK.signal. See the SDK's docs/signal-api.md for the supported methods and lifecycle.

Security Model

SecureBin separates app development, marketplace review, and marketplace signing. Developers build and test their own source locally. SecureBin signs installable marketplace packages only after approval.

• Do not include the SecureBin marketplace publisher private key in an app project or submission.
• Keep any optional developer signing private key under your control and out of source control.
• Declare only the permissions required by your app.
• Use a stable manifest app ID across updates.
• Submit the generated .sbapp-review.json file for marketplace review rather than a privately packaged .sbapp.

Marketplace signing is managed by SecureBin. Developers do not need access to SecureBin's publisher private key and should never request or distribute it.

Submitting for Review

When your app is ready, securebin submit validates the project, collects the source files included by the manifest, records file hashes, and writes a review submission.

node ..\bin\securebin.js submit --out dist\my-app.sbapp-review.json

Upload the resulting .sbapp-review.json file through the SecureBin developer upload page. Do not rename an HTML file or a legacy private .sbapp package to imitate a review submission.

The package command remains available for legacy private distribution. It is not the marketplace publishing workflow.

Publishing and Updates

1. Test locally

   Run dev and verify your app's interface, declared permissions, and supported runtime behavior.

2. Create a review submission

   Run submit and upload the generated .sbapp-review.json file with your App Store listing.

3. App review

   SecureBin reviews the submitted app and listing information before it becomes available in the App Store.

4. Marketplace publication

   Approved submissions are converted into an official signed .sbapp package by SecureBin.

5. Release an update

   Increase the app version, test the update, create a new review submission, and submit it from the app's edit page. The currently approved version remains available until the update is approved.

Your App Store listing contains customer-facing information such as the app name, description, category, screenshots, pricing, release notes, and requested permissions. Keep those details accurate and consistent with the submitted app.

In-App Purchases

Approved marketplace apps can offer one-time purchases or subscriptions configured from the SecureBin app management pages.

Each product uses a stable product id, a customer-facing name, and a type of one_time or subscription. One-time products use a flat price; subscription products can use monthly and yearly pricing.

[
  {"id":"pro","name":"Pro unlock","type":"one_time","price":4.99},
  {"id":"plus","name":"Plus","type":"subscription","price_monthly":2.99,"price_yearly":19.99}
]

Start purchases through the SecureBin-controlled checkout experience rather than collecting payment information inside your app.

<script src="/assets/js/securebin-iap.js"></script>
<button data-securebin-iap data-app-slug="your-app-slug" data-product-id="pro">
  Unlock Pro
</button>

You can also open checkout from JavaScript after a user action:

SecureBinIAP.openCheckout({
  appSlug: "your-app-slug",
  productId: "pro"
});

After checkout, your app can check whether the signed-in user currently has access to a product:

GET /assets/php/check_in_app_access.php?app=your-app-slug&product=pro

Use the SecureBin checkout and entitlement flow for purchase state. Do not attempt to create purchase or subscription records directly from app code.

Troubleshooting