Download Token Settings #
Control how long download links stay valid and how many times they can be used.
Token Expiration #
| Property | Description |
|---|---|
| Option | dmsilm_us_token_expiration |
| Default | 3600 seconds (1 hour) |
| Purpose | A download URL generated by the API is only valid for this duration |
When a client receives an update check response with a download URL, the URL contains an HMAC-signed token. After the token expires, the URL returns an error. The client can request a fresh download URL by making another update check.
Increase this to 24 hours (86400) if your users are on very slow connections that take longer than 1 hour to download.
Decrease this to reduce the window of opportunity if a token URL is accidentally shared.
Download Rate Limit #
| Property | Description |
|---|---|
| Option | dmsilm_us_download_rate_limit |
| Default | 10 downloads per hour per token |
| Purpose | Limit how many times one token can be used to download the file |
This prevents a single token from being used to download the file dozens of times in rapid succession. 10 per hour is sufficient for any normal use case (including HTTP Range request resume attempts).
Token Security #
Download tokens are signed with AUTH_KEY . AUTH_SALT from your wp-config.php. The token payload includes:
- License ID
- Product ID
- Version
- Version ID
- Expiry timestamp
- Unique nonce
Important: If you change AUTH_KEY or AUTH_SALT in wp-config.php (e.g., after site migration), all outstanding download tokens become immediately invalid. Clients will need to re-check for updates to get fresh tokens.