Plugin downloads

How the plugin .zip gets from our server into your hands.

The download flow

1. You log into your customer dashboard and click Generate download link on a license.
2. The portal asks an out-of-band worker to issue a signed URL. The URL contains a token that encodes your license id, product slug, expiration timestamp, and an HMAC-SHA256 signature using a server-side secret.
3. You click the URL. The portal validates the token (timing-safe HMAC compare), checks the license is still in good standing, and streams the .zip from a private storage area outside the public docroot.

Token TTL

The default TTL is 24 hours. You can re-generate a download link as many times as you want — the dashboard button always produces a fresh one.

Why the round-trip

Plugin .zips never live in the public docroot. Even if someone guessed the URL pattern they would not get the file — every download requires a freshly-signed token tied to a real, active license.

What is inside the .zip

The exact same files that ship to every customer with your same plugin version. There is no per-customer fingerprinting in the zip itself; per-customer identification happens at activation time via the license key.