Licensing and Credential Security

Product-scoped access, not a shared master key

Plugin credentials belong to a product and environment. Server checks tie activation and validation to the product, customer entitlement, device, and applicable activation limits. Developer dashboard credentials should not be embedded in a plugin.

Activation is different from validation

Activation registers permitted use on a device. Validation checks whether the product can still be used under the current entitlement and license state. Deactivation releases a device slot where supported. Credential checks alone do not establish that a customer owns a product.

Package-specific access policy

JUCE 0.7.2 supports signed offline access for the grace period selected in product Access settings, through 90 days. A prior successful activation or validation and the matching package verification keys are required. Startup uses a verified unexpired grant or online authorization. Zero, disabled, missing or expired grace requires online authorization; confirmed denial or deactivation locks access. Regenerate and rebuild older plugins to use this release.

HISEScript grace requires prior valid, unexpired access. Confirmed invalid or revoked access cannot be treated as a network failure. Native HISE requires the compiled authority to be present and tested.

Credentials shipped in software are extractable

Product-scoped credentials reduce scope but are not an unextractable secret. Rotation, revocation, server entitlement checks, and device policy remain necessary. Keep private account credentials and full serials out of public examples, logs, and screenshots.

Release testing belongs to the final build

Test customer login, serial claims, startup validation, device limits, deactivation, offline expiry, subscription state, refunds, and package regeneration in the exported product. A package download or screenshot does not prove every runtime state works.

SoundSync does not claim a security certification, a service-level uptime commitment, or an invulnerable client. The integration guides identify the relevant package and API behavior.

Protect your account with two-factor authentication

Add an authenticator to your SoundSync account and keep single-use recovery codes in a private place. Enabled accounts complete a two-factor challenge at sign-in. Team members use their own accounts and product-scoped permissions rather than sharing the owner login.

Signed offline access follows your product settings

Choose the grace period in product creation > Access. Successful activation or validation returns a signed grant bound to the product, activation and device. The period starts at that successful online check, not the first failed connection. The package bundles only public verification keys. Reopening the plugin or losing connectivity does not extend its signed expiry. An earlier entitlement or subscription access deadline shortens the grant.

The processor enforces access with the editor closed, including float, double and bypass processing. Confirmed revoked, refunded or deactivated access must lock the product rather than renew grace. A disconnected device learns about later server changes on reconnect or when its existing grant expires.

Regenerate the Windows or Apple source package, check manifest offlineAccess, rebuild and test your product. Existing compiled plugins are not upgraded automatically. Windows VST3 and Ableton Live 10.1.43 fixture tests cover offline playback, expiry, saved-project restart and WAV export; Apple Keychain/AU and your own product binaries require target-host testing.

offlineAccess: true describes bundled verification capability, not an active customer license or an enabled product policy. An older unsigned cache needs successful online activation or validation before offline use. After rebuilding, distribute the updated binary; replacing a ZIP in the dashboard cannot update customer installations.

Changing Access settings applies on the next successful online validation without a rebuild when the installed package already has the required public keys. A future signer change must be coordinated with replacement public keys in rebuilt clients; never add private signing material to a plugin.

Account sessions must be verifiable

A signed account token is not enough on its own: customer account requests also check that the session is still allowed. If that check is unavailable, protected library, invoice, review, device-reset, download and customer-token activation requests stop before returning private data or performing the protected action.

503 SESSION_VERIFICATION_UNAVAILABLE means verification could not finish. Retry after service recovery; it does not mean that the purchase disappeared or the session was confirmed revoked. A confirmed revoked session returns 401 LIBRARY_SESSION_REVOKED and requires sign-in again. Do not grant access on either response.

Shared library/download tokens retain their separate token and ownership checks. Optional storefront personalization can fall back to anonymous browsing when customer identity cannot be established; that does not authorize a private download. This account-session check does not replace the signed JUCE offline-grant policy.