Can unlocked packages be used to distribute an app to one's customers, as long as provided without fee? (same question but with fees here) Or would this constitute a commercial distribution in the sense of the "Master Subscription Agreement Developer Services" as long as the app has a commercial purpose?

Assume the packaged app calls a web service on my org, which a) allows my customers to synchronize data with me or b) create orders in my org. Is data synchronization "unlocked okay", order creation "managed only"?

2 Answers 2



That said, the reading of the MSA seems to be pretty clear cut. As long as you're not charging for the use of the App, you're free to distribute such an app to your customers. This includes even accepting orders through the App; you're not charging for the app, you're accepting payment for the product or service.

However, as the other Q&A mentions, your IP is not protected in an Unlocked Package. That means that anyone with sufficient permissions can read and even modify your code. You have no secrets in this package, including API keys, Named Credentials, or Security Certificates for secure communications. It's even technically possible to cause damage to customer data or metadata (e.g. by using the name of a class, field, etc that already exists in their org).

As such, even though the MSA technically allows your proposed use case, it is strongly recommended that you do not attempt to use Unlocked Packages for this purpose. That is not what they are designed for, and using them for this purpose basically has the same benefits as directly deploying metadata to their organization (which is to say, no extra benefits at all).

For just a few hundred dollars, you can become a Partner, get your Managed Package through Security Review, and then enjoy the extra benefits of being a Partner, including a listing on the AppExchange, improved support by being a Partner, improved security of your app (including Intellectual Property), and avoid any possible legal repercussions by complying with the various Agreements with Salesforce.

It may have been reasonable to do so in the past, but for new apps, you should definitely try to go through the normal channels.

Also note that, even without an ISV/Partner agreement, you can still distribute Managed Packages, which will confer protection of your IP and other secrets. You simply won't be listed on the AppExchange without being a Partner and going through a Security Review. And, of course, you still can't charge for the App unless you're Partner.

If you want to distribute your App for free, doing so with a Managed Package is recommended over an Unlocked Package, as a matter of security for your data and other secrets. There are, of course, some downsides to using Managed Packages, including restricted ability to delete and deprecated components, but these are more of a technical hinderance.

  • For ISV apps that are free, the cost of security review is 0 even for Managed Package. Commented Jul 26, 2021 at 12:57
  • 1
    @MohithShrivastava Becoming a Partner, though, requires two certs (either one cert each with two developers, or two certs with one developer). I'm glad to see that they dropped the $300/year cost for free apps, that was a major bummer, but it still requires like $200/year to maintain the certs.
    – sfdcfox
    Commented Jul 26, 2021 at 13:02
  • For ISV partners (Not a partner of type consultant), I believe there are no certs needed if you are selling through the AppExchange. Commented Jul 26, 2021 at 13:07
  • @MohithShrivastava partners.salesforce.com/s/education/consultants/…
    – sfdcfox
    Commented Jul 26, 2021 at 13:18
  • There are two different types, 1. Consulting partners - Certs are needed 2. ISV Partner - You need app for distribution, certs not mandatory Commented Jul 26, 2021 at 13:46

Unlocked packages do not need an ISV agreement for distribution, unlike Managed packages. You are free to distribute them without fees

If you are charging (with fees) and using it for commercial purposes then yes you need that MSA (for charging make sure you are a partner to Salesforce as ISV or System Integrator).

You cannot sell unlocked packages on AppExchange and they do not get the below

  • No security review from Salesforce
  • Your package code like Apex or Triggers are not IP Protected
  • You won't be able to get all the benefits partners to obtain with appexchange. Appexchange apps have features like feature Management, Distribute apps on Appexchange, Collect Leads


it's better to do an MSA if any of the developer resources are used for commercial app distribution. So do not use unlocked packages and distribute the code if it is commercial unless you are partner to Salesforce.

  • "You may not, without Our prior written consent, access or use any Salesforce services, including the Developer Services, to Commercially Distribute Your Application to third parties unless You are authorized to do so pursuant to a separate agreement with Us." -- It seems distributing code without a Managed Package for cost would be a big no-no. I feel like that this language is relatively new, but I wouldn't want to take my chances on a paid Unlocked Package.
    – sfdcfox
    Commented Jul 26, 2021 at 12:43
  • If they are System integrator partners they do not need that MSA as that's included with partner agreement. Commented Jul 26, 2021 at 12:44
  • @sfdcfox I just looked into it again, it's required to do an MSA if any of the developer resources are used for commercial app distribution so that mean this apply for unlocked packages. Commented Jul 26, 2021 at 12:49
  • @MohithShrivastava , thank you so much for your reply, but the one thing my client (for whom I was asking) won't want is sell his app to his customers. It's really about facilitating an order process between orgs via REST. I'm not sure I understand your last reply to sfdcfox. The key learning seems to be that both case (a) and (b) of my question are legal with unlocked packages (as the app is 100% for free). Commented Jul 26, 2021 at 15:46
  • If your client is a Salesforce customer I would just ask client to raise a partner case to confirm this. In my opinion this should be fine. Commented Jul 26, 2021 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .