Guide

Licence keys and entitlements, and how they differ

These two get used interchangeably and they are not the same thing. Conflating them is what produces the bug where a cancelled subscriber can still download, or a paying customer cannot.

A licence key is a record

It says: this buyer acquired this product, on this date, under these terms. It is historical and it does not expire because a purchase does not un-happen. Its jobs are proof of purchase, support lookup, and giving the buyer something to reference.

What a licence key is *not* is an access check. Asking "does this person hold a licence" answers a question about the past.

An entitlement is a live answer

It says: right now, this person may do this thing. It has a state and a validity window, and it is what gets checked at the moment of a download, a test attempt, or a metered feature call.

Entitlements can come from several places — a one-time purchase, an active subscription, a manual grant, a lifetime plan — and the thing being protected does not need to care which. That indirection is the entire point: the download path asks one question and does not need to know about payment models.

Why both

Subscriptions end; purchases do not: A cancelled subscriber keeps their purchase history and loses their access. Two different records, two different lifecycles.
Failed renewals need a grey area: A grace window keeps an entitlement alive while payment retries run, so a temporary failure does not lock a paying customer out. A purchase record has no equivalent state.
Support needs history: "I bought this last year" is a licence question. "Why can I not download it today" is an entitlement question. Answering the second requires the first.
One check, many sources: Adding a new way to grant access — a promotional grant, a bundle, an admin override — means creating an entitlement, not editing every gate.

Where signed URLs fit

Neither a licence nor an entitlement is the download link. The link should be generated per request, short-lived, and issued only after the entitlement check passes.

A permanent download URL is an access-control system that leaks by being forwarded. If the link outlives the check, the check may as well not exist.

How this platform models it

Every purchase mints a licence key for the buyer. Separately, an entitlement is granted — by the purchase, by a subscription, or by an administrative grant — and that entitlement is what is checked on every download and every gated test attempt. Downloads themselves are served through short-lived pre-signed URLs generated at request time.

Common questions

Do I need licence keys if I already have entitlements?

They answer different questions. The entitlement decides whether someone may act right now; the licence key records that a purchase happened. Support and proof-of-purchase need the record even when access has ended.

What happens to a licence key when a subscription is cancelled?

Nothing — a purchase record does not expire. What ends is the entitlement, which is why access stops while the history remains.

Why are download links short-lived?

Because a permanent link is an access check that can be forwarded. Generating a signed, time-boxed URL per request after the entitlement check keeps the check meaningful.