2.4 KiB
Executable File
Paddle sandbox checkout
Rsync Studio's licensing site now hosts a Paddle sandbox checkout at:
https://rsync.stage.absdev.net/buy
The macOS app opens this page from the Licence and General settings screens.
Stage environment
The stage .env must contain:
PADDLE_CLIENT_SIDE_TOKEN=test_...
PADDLE_ENVIRONMENT=sandbox
RSYNC_STUDIO_PURCHASE_URL=https://rsync.stage.absdev.net/buy
RSYNC_STUDIO_PORTAL_URL=https://rsync.stage.absdev.net/portal
RSYNC_STUDIO_SUPPORT_URL=https://rsync.stage.absdev.net/support
Keep PADDLE_API_KEY server-side. It must never be added to the macOS app or browser JavaScript.
The four Paddle catalog IDs remain configured through PADDLE_PERSONAL_* and PADDLE_PROFESSIONAL_* variables.
Checkout behavior
- Paddle.js is initialized with the sandbox client-side token.
- Prices are localized with
Paddle.PricePreview()when available, with the agreed GBP prices as a fallback. - Each plan opens Paddle's overlay checkout using the configured price ID.
- All plans advertise the configured 7-day Paddle trial.
- A successful Paddle subscription webhook provisions the licence and creates the encrypted delivery outbox record.
- After webhook processing, pending licence keys are sent by email on a best-effort basis without rolling back the verified webhook if mail delivery is temporarily unavailable.
macOS stage configuration
The app is configured for:
- API:
https://rsync.stage.absdev.net/api/ - Buy:
https://rsync.stage.absdev.net/buy - Portal:
https://rsync.stage.absdev.net/portal - Support:
https://rsync.stage.absdev.net/support - The current stage Ed25519 licence public key is embedded in
Info.plist.
The signing private seed remains server-only.
Remote portal deactivation
Rsync Studio revalidates an installed licence against POST /api/v1/validate on launch/resume and every 24 hours while running. The validation endpoint reads only the local licensing database; it does not call Paddle and therefore does not add Paddle API usage or transaction charges.
A successful validation refreshes the signed licence token so subscription entitlement changes are picked up. If an installation was deactivated in the customer portal, the server returns HTTP 403 and the app removes its local token immediately. Temporary network/server failures retain the locally signed licence for up to three days; after that grace period the app requires an online validation.