Developer docs

Hosted apps

Run a small web app inside a hub as a panel, hosted by Hubs and limited to what its bot was approved for.

A hosted app is a bot application plus a small static web bundle. Members open it from a channel's apps menu or the hub sidebar. The panel reaches Hubs only through a bridge that exposes the bot's own approved scopes, so an app can never do more than its bot was allowed to.

Upload a bundle

In the developer portal, pick the scopes your app needs on the Install tab.
Open the Hosted app tab, give the app a title, choose where members open it and upload your folder. Each upload is a new version, live at once in every hub that has the bot.
Share the install link as usual.

Bundle rules

Up to 40 files, 512 KB each and 1 MB in all, with an index.html at the top, in up to 4 folders.
File types: html, js, css, json, txt, png, jpg, jpeg, webp, woff2.
No inline scripts, inline event handlers, javascript: links, scripts from other sites, <base> or <meta http-equiv>. Load your code from .js files in the bundle.
A bot token anywhere in the files is revoked and the upload refused. Bundles are public like any web page; keep secrets out.

The bridge

Each call is a postMessage to window.parent with { protocol: "hubs-app-bridge/1", id, method, params }. Hubs answers { protocol, id, ok: true, result } or { protocol, id, ok: false, error: { code, message } }.

Method	Needs	Does
`context.get`	Nothing	Know which hub and channel it is open in, and your display name
`channel.read`	`messages:read` and `read_history`	Read recent messages in the current channel
`message.post`	`messages:write` and `send_messages`	Post in the current channel as the app, naming you
`modal.open`	Nothing	Ask you something in a Hubs dialog

Posts carry "Shared by" and the member's handle, up to 2,000 characters, and each member may post 6 times a minute through one app. Reads return up to 50 recent messages. Panel calls count against the bot's own limits.

The sandbox

Files are served with a sandbox Content Security Policy that gives the page its own opaque origin: it cannot read Hubs cookies, storage or pages.
Scripts, styles, images and fonts load only from the app's own version folder. No fetch, WebSockets, nested frames or workers: apps cannot call other services in this version.
The panel never sees a token. The member's session makes each call, and the server checks the member, the install and the bot's grants every time.