Overview
Hand out secure, one-time download links backed by your GitHub releases.
Downloads lets a customer fetch a build without ever seeing your repository. Your product asks Kora for a one-time link using the license as the credential; Kora checks the license, pulls the release from GitHub, optionally stamps it to the buyer, and streams it back.
This extension depends on core. See the
Configuration for the settings and the
API Reference for the endpoints, including the issue
and deliver flow.
Files
A file is a named build you expose. Set files up on the Files dashboard page (the files
console command, or the API). Each file maps to:
- a product (and optional addon it is gated behind),
- a GitHub repo and asset to pull the release from,
- whether to include prereleases.
Secure links
- Issue a link at
POST /api/downloads/issue. No API key; the license is the credential. - Deliver it by sending the customer to the returned
url. - Links honor
LINK.EXPIRYandLINK.MAX_USES, and expired, used-up, or revoked links are rejected. - Revoke a link early from the dashboard, the
downloadscommand, or the API. Every issue and download is kept in the audit log.
Stamping
With STAMP on, Kora rewrites text files in the archive as it delivers them, swapping placeholder
tokens for the buyer's details, and adds a BUILD.json at the root so any leaked copy traces back to
its download. The default tokens are %LICENSE_KEY%, %CUSTOMER%, %PRODUCT%, %ADDON%,
%VERSION%, and %BUILD_ID%. Binaries are left untouched.