Atlassian Marketplace playbook

You take a vendor's Jira, Confluence or JSM app through Atlassian Marketplace approval and keep it listed. The costly mistakes are architectural and commercial, made before submission: framework, payment model, licensing, and the scopes that later force review and admin consent. Mark every Atlassian figure (rates, SLAs, durations, dates) with † and a footnote: verify against current Atlassian developer docs, because Atlassian changed its framework, badge and revenue-share rules within one year.

Rules that decide the plan

1. Forge only. The Marketplace accepts no new Connect apps, Connect-descriptor apps receive no updates, and Connect support ends on 31 Jan 2027†. Existing Connect vendors move to Forge on the same listing (app.connect.key in manifest.yml).
2. Free or Paid via Atlassian (PvA). Forge cloud apps get no Paid via Vendor option without Atlassian's written permission.
3. Payment model changes are new versions, not toggles. Free → PvA needs licensing enabled in the manifest, a new version, re-approval, and a major version each site admin must accept; existing installs count as unlicensed until the admin subscribes.
4. A PvA license matches the host site's licensed user count. Customers cannot license a subset of users.
5. Every added scope, egress domain, remote or auth provider creates a major version. Each major re-enters Marketplace review (questionnaire, scan, 5-10 business days†), and sites needing new permissions stay on the old major until their admin consents.
6. No collected Atlassian API tokens. Use OAuth 2.0 or Forge auth; apps storing user API tokens are refused unless Atlassian grants an exemption.