How a key behaves.

Activate

Install the package, paste the key, bind the site URL. A key is not a zip password; it is a seat.

Update

While the subscription is warm, the studio endpoint serves updates. When it cools, the last build stays. We do not remote-disable your content.

Move

Staging plus production on the same domain family is one seat. A second client site is another seat — or All Access with five / unlimited.

School suite

Learn, Pay, Assess, and Leitner are one product that happens to ship as plugins. If a screen says a sibling is required, believe it.

Vault

Installers never sit in public_html. The desk signs a ten-minute download token after verify. There is no directory listing and no “latest.zip” URL to guess.

Verify API

POST /api/license/verify with license, site, and plugin. The package answers with entitlements and a one-time download token. POST /api/license/update-check is what WordPress calls for updates. GET /api/license/download?token= streams the zip.

Seats

A key is bound to the registrable hostname. www and staging on the same domain family share the seat. A second client site needs another seat — or All Access with five / unlimited.

What we will not claim

We will not pretend PHP is uncopyable. Stolen files do not get updates, new zips, or a warm key. Content already on the site stays. That is the contract.