Looking for an idiot's guide to using FastSpring licence codes

Plugin Marketplace
1

Hi all. I’m getting close to finalising a plugin that I plan to put on the marketplace and I’ve been looking at everything I can find on security.

Adobe (https://developer-stage.adobe.com/developer-distribution/creative-cloud/docs/guides/faq/) says “Our payment vendor FastSpring offers an extra layer of security to a paid plugin through license codes. When set up, plugin customers will receive a unique license code in their receipt email to ensure your plugin is unlocked by only them.”, and there’s a link to how to create codes.

All of the FastSpring developer docs at https://developer.fastspring.com/reference/developer-documentation-hub appear to be related to storefronts rather than products.

Now I get that the sales/commercial parts are really important, but surely there’s something on what you need to do in the products themselves?

So I still have some really basic questions:

  • Do I need to add anything into my plugin to accept a licence code and authenticate it?

  • if so, what?

I’m hoping there’s a nice idiot’s guide somewhere already, but I’d be very grateful for any pointers!

Thanks

2

Never had to deal with any licence codes. I guess Marketplace handles this maybe :thinking: Probably these licences are needed if you distribute your plugin outside of Marketplace and handle everything yourself

3

Hi @MartinB,

This is, indeed, somewhat confusing.

Using license codes is optional in the Adobe Exchange Marketplace. You can use them to add more security but you don’t have to.

There is some built-in security, where users who purchase through the Marketplace get an entitlement check through the Creative Cloud desktop app. Very clever and determined users have found ways around this.

Both yes and no… If you distribute on your own, license codes are a good way to manage user entitlement, and that’s how most people do it.

If you want to add event more entitlement checks to a Marketplace-distributed plugin you can optionally add FastSpring license keys.

  • Do I need to add anything into my plugin to accept a licence code and authenticate it?

:thinking: It does seem like you would… but yeah, I can’t find anything about that in the linked documentation. Maybe reach out to them?

For FastSpring questions about fulfillment codes, email support@fastspring.com.

4

Thanks Erin, I’ll drop them a line. In the meantime could you please confirm the following:

a) I need to sign up with FastSpring if I’m submitting paid plugins because that’s how money from any sales is sent, regardless of how I secure the plugin?

And then I have a choice between:

b) I rely on the security built into Marketplace, supplemented as I see fit with code obfuscation, internal consistency checks etc, and completely ignore the FastSpring codes; or

c) I do whatever is required using FastSpring’s APIs to send their codes to customers and then to allow them to enter the code into the plugin and validate it (probably in conjunction with code obfuscation and consistency checks)

Is that all correct?

Thanks

5

@rauchwer is the real expert on this, but I’ll try to answer:

a) I need to sign up with FastSpring if I’m submitting paid plugins because that’s how money from any sales is sent, regardless of how I secure the plugin?

Correct!

And then I have a choice between:

b) I rely on the security built into Marketplace, supplemented as I see fit with code obfuscation, internal consistency checks etc, and completely ignore the FastSpring codes; or

This is correct, with the tiny detail of the word “ignore”. FastSpring won’t generate any codes unless you request them, as is my understanding. Instead of “ignore” I might say “not bother with”.

c) I do whatever is required using FastSpring’s APIs to send their codes to customers and then to allow them to enter the code into the plugin and validate it (probably in conjunction with code obfuscation and consistency checks)

Correct.

6

Many thanks for the confirmation, Erin.

I’ve had a reply to my query to FastSpring’s support line:

Adobe creates products in their store. Unfortunately, we don’t have any solution for authenticating your license code in app. We also don’t encrypt the file fulfillment - it is delivered as-is.

I’m reading that as them saying they don’t know how you’d use their licence codes in a plugin either.

I’m not intending to roll up a cloud-based online authentication system, which is all I can come up with to make use of those keys based on the info to date. Guess I’d better polish up my obfuscation!

7

This topic about obfuscation might help if you need some ideas

8

Thanks Karmalakas. It was actually that topic that started me down this thought process. Some very useful comments there!

1 Like
9

I had the same issue when trying to figure out licensing for my plugins.
For Fastspring, it seemed like they don’t want you to be able to figure it out and want you to use their other service licensespring.com

You could go the simple (but less secure way) and just come up with a license key algorithm and generate a bunch of serials and give to fastspring and then have your plugin check the serial against some logic to see if it is one of yours.

But checking with an online db is what I wanted and I couldn’t figure it out with fastspring. I am currently not selling on the adobe marketplace, so I ended up just rolling my own with lemonsqueezy as they have an easy to understand API for that.

1 Like
10

Thanks @JasonM . Interesting and it all makes sense. I’m just starting and don’t expect volumes to justify anything like signing with LemonSqueezy, but useful information regardless.