Licence-key gated downloads: one route, no database, no secret
Paste a licence key, get the file. How we built on-site downloads with one edge function, a public key check and files no URL reaches without a key.
Email delivery loses purchases. A typo in the address, a spam folder, a link that expired overnight. So we let the licence key be the access: paste it on the site, get the ZIP.
The flow
- After payment, the provider appends the licence key to the return URL. The page shows it with a Copy button.
- Download sends the key to one route,
POST /api/download. - That route calls the provider's public activate endpoint. A valid key returns the product it was bought for.
- The product id maps to a file, and the file streams back with a download header.
What keeps it small
- One route. Every other request goes to static files without running a line of code.
- No secret. The key check is a public endpoint.
- No database. The provider knows whether a key is real, what it bought and how many uses are left.
- Files bundled into the function. They are a few kilobytes each, and not served as public assets, so no URL reaches them without a key.
Limits worth setting
Each download counts as one activation, and we allow five per key. That covers a new laptop and a reinstall, and stops a key pasted into a forum from working for long. A refund revokes the key, so its downloads stop.
Be honest about what this does not do: it does not protect a file after download. For a Claude Code skill, which Claude reads as plain text, nothing could. What you are protecting is access, updates and support, which is also what buyers are paying for. The rest of the setup is in selling downloads without a backend.
Questions
Does a licence key stop people sharing a downloaded file?
No. Once a file is on someone's disk it can be copied. The key controls who can get the file from you, caps how many times one key can be used, and is revoked on refund.
Where should the files live?
Somewhere no public URL reaches: private object storage, or bundled into the function itself if they are small. Never in the site's public folder, which is a free download.
Do I need an API secret to check a licence key?
Not with every provider. Ours exposes a public activate endpoint that returns which product a key was bought for, so the function holds no secret at all.