Secure Download Endpoint #

Files are never served directly. All downloads go through this signed-token endpoint.

Endpoint #

GET /dmsilm-download/?token={HMAC_TOKEN}

This is not a REST API endpoint under /wp-json/. It is a custom WordPress rewrite rule that intercepts requests at template_redirect.

How Tokens Are Generated #

When the update check API returns a download_url, the URL already contains a signed token. Client software does not generate tokens; it receives them from the update check or version list endpoints.

Token Format #

The token is a URL-safe base64 encoding of:

base64(JSON_payload) | HMAC-SHA256-signature

The JSON payload contains:

{
  "license_id": 123,
  "product_id": 42,
  "version": "2.0.0",
  "version_id": 89,
  "expires": 1710003600,
  "nonce": "abc123"
}

The HMAC signature uses AUTH_KEY . AUTH_SALT from wp-config.php.

Download Flow #

1. Client sends GET request to /dmsilm-download/?token=...
2. Server validates HMAC signature
3. Server checks token has not expired
4. Server verifies the license is still active
5. Server checks download rate limit for this token
6. Server streams the file with these headers:
   • Content-Type: application/zip
   • Content-Length: {file size}
   • X-Checksum-Sha256: {hash}
   • Digest: sha-256={base64 hash}
   • ETag: {hash}
   • Accept-Ranges: bytes

HTTP Range Support #

The download endpoint supports HTTP Range requests. This means:

• Interrupted downloads can resume without restarting from the beginning
• Download managers can use parallel range downloads for faster speeds

The server returns HTTP 206 Partial Content for range requests and HTTP 200 for full-file requests.

Error Responses #

Important: AUTH_KEY and AUTH_SALT #

Token security depends on AUTH_KEY and AUTH_SALT in wp-config.php. If these values change:

• All outstanding tokens become invalid immediately
• Clients with a cached download URL will get a 401 error
• They must call the update check endpoint again to get a fresh URL

This happens during site migrations or security key rotations. It resolves itself automatically as clients re-check for updates.

Related Topics #

• Check for Updates Endpoint
• Download Token Settings
• Troubleshooting Download Issues