Updates Delivery
How a customer site receives an update#
Your plugin (with the client SDK) sends a POST /update/check request to your site with its license key, product slug, current version and domain. License Cart:
- validates the key, checks it belongs to the requested product and is active and not expired,
- checks the requesting domain is one of the key’s activations,
- looks up the newest active release for the product, and
- if its version is higher than the installed one, returns the version, changelog, PHP/WordPress requirements and a signed download URL.
The download URL points to GET /update/download?token=… on your site. The token is an HMAC-signed claim containing the release ID, license ID, domain and an expiry of five minutes. When WordPress fetches it, License Cart re-checks that the license is still active and the domain still activated, then streams the ZIP from wp-content/uploads/lc-releases/ with a clean file name such as my-plugin-v1.2.0.zip.
Because the file is never exposed by a permanent URL, a leaked link stops working after five minutes and a cancelled license cannot download even inside that window.
What the customer sees#
With the client SDK in place, updates appear on Dashboard → Updates and on the Plugins screen exactly like WordPress.org updates, including the changelog in View version details. If the license is inactive, expired or revoked, no update is shown and the License screen explains why.
Rate limits#
Public endpoints are rate-limited per IP address: 30 requests per minute for activate and deactivate, 60 per minute for status, update check and download. Exceeding the limit returns HTTP 429 with a retry_after value. The bundled client SDK treats 429 and 5xx responses as temporary and keeps the last verified status for a grace period.