Digital Products

Digital Products

Overview

Selling digital products — ebooks, software licenses, templates, music, courses — requires secure delivery after payment, download limits to prevent unauthorized sharing, and expiring access links. Every major platform either has this built in (WooCommerce) or has a mature app that handles it (Shopify, BigCommerce). Use the platform's native solution first; only build custom delivery infrastructure if your use case (complex license key management, subscription-gated content libraries) exceeds what apps offer.

When to Use This Skill

• When adding downloadable products (PDFs, software, audio, templates) to an existing store
• When implementing a license key delivery system for software products
• When building a subscription that gates access to a digital content library
• When replacing publicly accessible download URLs with secure, expiring signed URLs

Core Instructions

Step 1: Determine platform and choose the right tool

---

Step 2: Platform-specific setup

---

Shopify

Shopify does not have native digital product support — you need an app. Sky Pilot is the most feature-complete option.

Setting up Sky Pilot:

1. Install Sky Pilot from the Shopify App Store 2. Go to Sky Pilot → Files → Upload your digital file (PDF, ZIP, etc.) 3. Go to Sky Pilot → Products and link the uploaded file to a specific product or variant 4. Configure delivery settings:

• Download limit: set to 3–5 for standard products, unlimited for subscriptions
• Link expiry: 48–72 hours is standard; customers can request a new link from their account
• Automatic delivery: enabled by default — customers receive a download email immediately after payment

5. Customize the delivery email under Sky Pilot → Settings → Email template

For license key products: 1. In Sky Pilot, go to License Keys → Import and upload a CSV of your license keys 2. Link the license key pool to the product 3. Sky Pilot automatically assigns one key per purchase and includes it in the delivery email

For subscription-gated content (Sky Pilot + Recharge):

• Sky Pilot integrates with Recharge — customers with an active subscription automatically gain access; access is revoked when the subscription cancels

---

WooCommerce

WooCommerce has digital product delivery built in — no extra plugin required for basic use.

Setting up a downloadable product:

1. Go to WooCommerce → Products → Add Product 2. Check Downloadable (and optionally Virtual to skip shipping) 3. Under Product Data → Downloadable Files:

• Click Add File and upload the file or enter a URL
• File name: the name shown to customers in their account

4. Configure access settings:

• Download limit: enter a number (e.g., 5) or leave blank for unlimited
• Download expiry: number of days after purchase (e.g., 365), or leave blank for no expiry

5. WooCommerce generates a secure, token-based download URL for each purchase automatically

Forcing customer account for downloads:

• Go to WooCommerce → Settings → Accounts & Privacy
• Enable Grant access to downloadable products after payment and Require login to download

For license key products:

• Install License Manager for WooCommerce (free plugin)
• Go to License Manager → Add License Keys and bulk import your keys
• Link the license key pool to a product
• The plugin delivers keys in the order confirmation email and the customer's account page

---

BigCommerce

Setting up digital delivery (built-in):

1. Go to Products → Add Product 2. Under Files, upload your digital file (BigCommerce supports files up to 512 MB) 3. Set Max downloads to limit how many times the file can be downloaded per order 4. BigCommerce sends an automatic download email after payment with a secure link

For more advanced delivery:

• Install SendOwl or Fileflare from the BigCommerce App Marketplace
• These apps add license key management, download analytics, and streaming video delivery

---

Custom / Headless

For headless storefronts, implement secure file delivery using S3 presigned URLs — never expose the raw S3 key:

import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3 = new S3Client({ region: process.env.AWS_REGION });

// Generate a short-lived presigned URL for each download attempt
export async function generateDownloadUrl(orderId: string, digitalProductId: string) {
  const access = await db.orderDigitalAccess.findUnique({
    where: { orderId_digitalProductId: { orderId, digitalProductId } },
    include: { digitalProduct: true },
  });

  if (!access) throw new Error('No access record found');
  if (access.expiresAt && access.expiresAt < new Date()) throw new Error('Download access has expired');
  if (access.maxDownloads && access.downloadCount >= access.maxDownloads) throw new Error('Download limit reached');

  // Atomically increment download count
  await db.orderDigitalAccess.update({ where: { id: access.id }, data: { downloadCount: { increment: 1 } } });

  // 60-second presigned URL — short enough to prevent sharing, long enough for the redirect
  const command = new GetObjectCommand({
    Bucket: process.env.DIGITAL_PRODUCTS_BUCKET,
    Key: access.digitalProduct.fileStorageKey,
    ResponseContentDisposition: `attachment; filename="${access.digitalProduct.fileName}"`,
  });

  return getSignedUrl(s3, command, { expiresIn: 60 });
}

// Provision access after payment — call this from your payment webhook
export async function provisionDigitalAccess(orderId: string) {
  const order = await db.orders.findUnique({
    where: { id: orderId },
    include: { items: { include: { variant: { include: { digitalProduct: true } } } } },
  });

  for (const item of order.items.filter(i => i.variant.digitalProduct)) {
    const dp = item.variant.digitalProduct;
    await db.orderDigitalAccess.upsert({
      where: { orderId_digitalProductId: { orderId, digitalProductId: dp.id } },
      create: {
        orderId, digitalProductId: dp.id, downloadCount: 0,
        maxDownloads: dp.downloadLimit,
        expiresAt: dp.accessDurationDays ? new Date(Date.now() + dp.accessDurationDays * 86400000) : null,
      },
      update: {}, // Idempotent — webhooks can fire multiple times
    });
  }
}

// License key pool management
export async function assignLicenseKey(orderId: string, productId: string) {
  return db.$transaction(async tx => {
    const license = await tx.digitalProductLicenses.findFirst({
      where: { productId, status: 'available' },
    });
    if (!license) throw new Error(`No available license keys for product ${productId}`);
    await tx.digitalProductLicenses.update({
      where: { id: license.id },
      data: { status: 'sold', orderId, soldAt: new Date() },
    });
    return license.licenseKey;
  });
}

---

Step 3: Configure post-purchase delivery email

All platforms send an automatic delivery email — customize it to be clear and professional:

Content to include:

• Order confirmation number
• Product name and description
• Download link (or license key, displayed prominently)
• Download limit and expiry date if applicable
• Instructions for how to access/install the product
• Support contact if they have trouble

Shopify (Sky Pilot): Customize under Sky Pilot → Settings → Email Template

WooCommerce: Customize under WooCommerce → Settings → Emails → Customer Processing Order (includes download links automatically)

BigCommerce: Customize under Marketing → Transactional Emails → Order Status Notification

---

Step 4: Monitor license key inventory

For license key products, set up alerts before keys run out:

• Sky Pilot: Go to License Keys → [Product] — shows remaining key count; Sky Pilot sends email alerts when stock drops below a threshold you configure
• License Manager for WooCommerce: Dashboard shows keys remaining per product with color-coded warnings
• Custom: Run a daily check and alert when available keys drop below 10

Best Practices

• Never deliver digital products until payment is confirmed — trigger delivery from the payment confirmed webhook, not the order created event; card declines happen after order creation
• Use short-lived download links (60 seconds) for headless implementations — generate the URL fresh on each download page load, not when the page renders
• Set download limits for most products — 3–5 downloads is standard; unlimited for subscription access; limits prevent casual file sharing
• Store files in private buckets — never make your S3/GCS bucket public; all access must go through signed URL generation
• Monitor license key inventory — running out of keys causes support tickets and chargebacks; set up alerts when below 20% of original inventory
• Send a separate, dedicated delivery email — don't bundle license keys into the generic order confirmation; a focused delivery email is easier for customers to find and reference

Common Pitfalls

Related Skills

• @inventory-tracking
• @low-stock-alerts
• @product-data-modeling

License Key Inventory System

Problem Description

A software marketplace sells third-party applications where each sale requires issuing a unique license key to the customer. The keys are pre-purchased in bulk from vendors and need to be stored and dispensed one-by-one as orders come in. The ops team currently tracks these keys in spreadsheets and manually emails them — a process that takes hours and frequently causes customer complaints when they don't receive their key promptly.

The engineering team needs to automate this. The backend is Node.js with a Prisma-like db client. The digitalProductLicenses table already exists with columns: id, productId, licenseKey, status (one of 'available', 'sold', 'revoked'), orderId, soldAt.

A vendor has just delivered a CSV of 500 new keys for a popular product. The ops manager wants an admin API endpoint to import those keys and is worried about accidentally uploading the same batch twice.

Additionally, the ops team has been caught off-guard twice when a product ran out of keys mid-sale, causing failed orders and angry customers. They need a scheduled job that warns them early enough to re-order from the vendor before stock runs out.

Output Specification

Implement the following in a file api/admin/license-keys.js:

• An async function importLicenseKeys(req, res) that handles POST requests with { productId, keys: string[] } in the body.
• An async function assignLicenseKey(orderId, productId) that picks an available key and assigns it to an order.

Implement the inventory monitoring logic in jobs/licenseKeyStockCheck.js, exporting an async function checkLicenseKeyStockLevels(). Assume a notifyAdmin({ subject, message }) function is available.

Add comments in assignLicenseKey explaining the concurrency concern it addresses.

Input Files

The following files are provided as inputs. Extract them before beginning.

=============== FILE: inputs/sample-keys.csv =============== product_id,license_key prod_antivirus_pro,AAAA-BBBB-CCCC-1111 prod_antivirus_pro,DDDD-EEEE-FFFF-2222 prod_antivirus_pro,GGGG-HHHH-IIII-3333 prod_antivirus_pro,JJJJ-KKKK-LLLL-4444 prod_antivirus_pro,MMMM-NNNN-OOOO-5555

Wire Up Post-Payment Digital Goods Delivery

Problem Description

A growing online marketplace has recently added digital products (e-books, software bundles) alongside their existing physical goods catalogue. The engineering team has wired up Stripe for payments, but the post-payment delivery of digital goods hasn't been implemented yet. Customers complete checkout and their payment goes through, but they never receive their download links or license keys — leading to a wave of support tickets.

The backend is Node.js with a Prisma ORM (db). The Stripe webhook infrastructure is already in place: the webhookRouter receives Stripe events and dispatches them to handler functions. The existing order structure looks like this:

// order → items → variant → digitalProduct (may be null for physical items)
// digitalProduct fields: id, downloadLimit (int|null), accessDurationDays (int|null), type ('file'|'license_key')

The orderDigitalAccess table stores per-order entitlements. The digitalProductLicenses table holds license keys. An emailService.send({ to, template, data }) function is available for sending emails.

There is a known problem: the payment provider occasionally fires the same webhook event more than once. The team was burned by a previous bug where duplicate processing sent customers two copies of an order confirmation, so they are particularly sensitive to any double-processing issues.

A second concern from the product team: customers have previously complained about license keys appearing in the standard order confirmation email, which they then accidentally forwarded to colleagues. The team wants digital delivery handled through a different communication channel.

Output Specification

Implement the provisioning logic in lib/provisionDigitalAccess.js, exporting an async function provisionDigitalAccess(orderId).

Implement (or update) the Stripe webhook handler file webhooks/stripe.js to call provisionDigitalAccess at the correct point in the payment lifecycle. The file should export a handleStripeWebhook(event) function.

Implement the delivery email helper in lib/digitalDeliveryEmail.js, exporting sendDigitalDeliveryEmail(order, digitalItems).

Add comments in provisionDigitalAccess.js explaining how re-entrancy / duplicate events are handled.

Implement the Digital Download API Endpoint

Problem Description

An e-commerce platform sells digital goods (PDFs, software binaries, audio files). The product files are stored in a private cloud storage bucket. Currently there is no way for customers to actually retrieve their purchased files — the platform has a basic database schema and a stub API route, but the actual file delivery logic is missing.

The platform backend is Node.js. Files are stored in S3. The existing database (db) uses a Prisma-like API. The relevant tables are already set up:

• orderDigitalAccess: tracks per-order download entitlements with fields orderId, digitalProductId, downloadCount, maxDownloads (null = unlimited), expiresAt (null = perpetual), and a composite unique key orderId_digitalProductId.
• digitalProducts: metadata for each product with fields fileStorageKey, fileName, mimeType, downloadLimit, accessDurationDays.

The product manager has flagged several requirements: 1. Customers should not be able to share or reuse download links — links must expire quickly. 2. Some products have download limits (e.g., max 5 downloads per order). The system must enforce these. 3. Some products are only accessible for a limited time window (e.g., 1 year after purchase). The system must enforce these too. 4. Files must never be served directly through the application server.

Output Specification

Implement the file delivery logic in a file called lib/digitalDelivery.js. This file should export an async function generateDownloadUrl(orderId, digitalProductId) that enforces all access rules and returns a download URL.

Also implement the API route handler in api/orders/[orderId]/downloads/[digitalProductId].js that calls generateDownloadUrl and returns { downloadUrl } on success, or an appropriate error response.

Write a package.json listing the npm dependencies your implementation requires.

Include brief inline comments explaining the access-check sequence in digitalDelivery.js.