Build for Dunea

The Dunea marketplace lists four kinds of listings, all built by creators outside Dunea:

• Plugins connect a Dunea app to your own service. A plugin can receive events (an order was paid, a form was submitted), read and change the app's data through the Plugin API, give the Dunea AI new tools (free or priced per call), add a panel to the workbench and add scripts to the published site.
• Themes are design data: colour and type tokens, fonts, and a written style guide that the Dunea AI follows when it designs an app. A theme contains no code.
• Templates are whole Dunea sites that owners remix into a new app of their own. See Templates.
• Skills are written know-how the Dunea AI follows while it builds an app, such as the rules for a kind of business or market. See Skills.

Only plugins run code, on your own servers. Themes, templates and skills are data.

Every listing is described by a manifest, a JSON object you submit to the marketplace. Dunea validates every manifest with the schemas in @dunea/plugin-sdk, so the validator you run locally is the one the marketplace runs.

How a plugin works

Dunea never runs a plugin's backend code. A plugin is a manifest plus an HTTPS service that you host. Dunea talks to that service, and your service talks back to Dunea with a token that only allows what the app owner approved.

                    signed webhooks (events you subscribe to)
   Dunea  ─────────────────────────────────────────────────▶  your service
                    signed tool calls (agentTools)            (webhookUrl)
   Dunea AI ───────────────────────────────────────────────▶
                                                                  │
   Plugin API v1  ◀───────────── install access token ────────────┘
   (only the permissions the owner granted, for that one app)

   workbench ─────── sandboxed iframe + session token ─────▶  your panel URL
   published site ── <script src>, after visitor consent ──▶  your CDN

The security model

• Your code, your servers. Dunea calls your HTTPS endpoints. It does not execute your backend.
• The owner approves permissions. At install, the app owner sees every permission your plugin asks for, with a plain-language label, and approves the list. Your token can do nothing else.
• One token per install. Each install gets its own access token, scoped to one app. Dunea sends it to you once, in the plugin.installed event.
• Every request is signed. Webhooks and tool calls carry an HMAC-SHA256 signature made with your client secret. Reject anything unsigned, or signed more than 5 minutes ago.
• Scripts wait for consent. Site scripts load only after the visitor consents to their category, and every script is reviewed by hand.
• Every version is reviewed. Nothing reaches the marketplace, and no update reaches existing installs, without review. Updates that change nothing an owner approved or pays can be fast-tracked.

What you need

• A Dunea account, and a developer profile on it
• For plugins: an HTTPS endpoint you control, and somewhere to store install tokens securely
• For anything paid: a Stripe Connect account for payouts (set up from the developer portal)
• Node.js 18 or later to use @dunea/plugin-sdk and the dunea-plugin CLI

Start here

How you earn

Sell listings once or monthly, charge per use for AI tools and metered usage, earn a share of what the customers you bring spend, and find client work through the Experts directory. Every creator keeps 100% of their first $25,000. See Ways to earn.

Reference