Extension SDK Best Practices/Tips and Tricks | XM Community
Skip to main content

We have been working behind the scenes on the Extension SDK for a while now and there are a few things that have come up a number of times. This post will be geared towards aggregating best practices, so if you have any good tips or tricks while you are building, share them here with the rest of the community!
Security:
Security is our top priority and with the introduction of the SDK, we’re allowing you to integrate and introduce your own systems into the Qualtrics platform with relative ease. This means that we’re now sharing the security responsibilities. Be mindful of how your services are exposed and how you choose to show any embedded dashboards within your own systems. 
We support four authentication schemes: OAuth 2.0, Basic Authentication, API Key, and SFTP. Our recommendation is to use OAuth 2.0 as it has multiple advantages over the others. 
Development

  • During development, use npm start or npm run build-dev because it generates unminified versions of your code. This makes it easier to walk through with break points. When you’re ready to submit, use npm run build. 

  • Develop against your sandbox brand, not production brand.

Integration into Qualtrics
Since you’re building for the Qualtrics platform and other Qualtrics customers, you will need to abide by the Qualtrics Style Guide to maintain a common look and feel. Make sure you follow it!
Certification:
Certification is for our partners who intend to share their extensions with the community at large. If you’re reading this and don’t fall into that category, but are interested, let us know by filling out our survey!
  • The policies really are a checklist. Make sure you are able to satisfy every one of the relevant policies. 

  • We’ve seen a few customers trip up on 4.18 specifically. Since the extensions are used as part of the Qualtrics platform, you need to ensure that the whole Qualtrics userbase can use your extension. This means additional compatibility tests you may not have needed to run in the past. 

It can take up to 4 weeks for you to reach the front of the certification line. Plan to have your extension certified well before your planned release date.

UPDATE: Found the answer in the SDK documentation…

 

The inclusion of language about certification on public extensions and its exclusion on private extensions would suggest we do not need certification when only sharing our extensions with specific clients.

 

ORIGINAL:

@qHubert

Certification is for our partners who intend to share their extensions with the community at large.

If we are not sharing with the community at large, but instead are sharing extensions with specific clients only (1-by-1), does that mean we do not fall under the requirement of certification?


Yep, that’s exactly it. 

 

We have a few different ways of sharing with your customers: 

Private extensions are usually going to be 1:1 bespoke for your client. The contract is between you and the client, so this doesn’t have to go through certification. If you would like to, you are absolutely welcome to request certification from our team as well, but definitely not required. 

Public extensions will typically result in a listing on our XM Marketplace and do need to be certified. 

There are some stark differences when it comes to sharing with the two types of extensions. With private, a brand admin of your customer has to be on your extension team. Then you can share with their brand.

With public extensions, you can preview your extension with a number of customers without adding them to your developer team. The assumption is that you’ll preview with your customers and then eventually release a new, updated GA version that will go to everyone.

Hope that helps!

#LetsGoBuildXM!


Leave a Reply