Case 10 · Commerce
Sold once.
Trusted every day.
The commerce system behind WPress Sentinel: Stripe Checkout embedded in presssentinel.com, a licensing server that issues, activates and moves keys, and a plugin that believes only answers it can verify.
- 01 // Role
- Commerce architecture · Engineering
- 02 // Parts
- Checkout · licensing server · plugin client
- 03 // Payments
- Stripe Checkout + Billing
- 04 // Status
- Live — presssentinel.com
A The brief
Selling a security plugin means the sale is the easy part. Every site then asks, every day, whether it is still allowed to run — and that answer has to be impossible to forge, survive the licence server being down, and never lock out a paying customer by mistake.
A.2 What it had to do
- 01A checkout on our own site, with card data never touching our server
- 02Licences issued the moment payment clears — exactly once
- 03Answers the plugin can prove came from us
- 04Paying customers never locked out by an outage
B · Checkout to licence
Bought. Issued. Verified.
Follow one purchase from checkout to an activated site. Then take the licence server offline, or refund the order, and see how the plugin answers each.
- 01CheckoutEmbedded Stripe Checkout · price fixed by the server
- 02WebhookSignature checked · each session handled once
- 03Licence issuedStored hashed and encrypted · emailed
- 04Site activatedSeat claimed atomically · site fingerprint hashed
- 05Answer verifiedEd25519 signature · bundled public key
Licence
WPS-····-····-····-····0 / 1 site · —
Customer site · wp-admin
Only the licence screen is available.
C · Capabilities
What it does.
- 01Embedded checkout
- Stripe Checkout inside presssentinel.com. The server sets price, mode and quantity — nothing in the page can change them.
- 02Issued once
- Each paid session can create one licence and only one; a repeated webhook is recognised and ignored.
- 03Keys that read clearly
- WPS- keys from an alphabet without 0, O, 1 or I, stored as a hash for lookup and encrypted for resending.
- 04Seats claimed atomically
- One site per licence, claimed in a single database step — and re-activating the same site never costs a seat.
- 05Moving house
- Move a licence to a new site yourself, or automatically once the old one has been silent for 72 hours — with an emailed undo link.
- 06Self-serve billing
- Cancel, change the card or download invoices in Stripe’s customer portal, reached by a signed link.
- 07Signed updates
- Update metadata carries the package’s checksum and size; downloads use 15-minute tokens with no key in the URL.
- 08Seven-day grace
- If the licence server can’t be reached, the last signed “valid” holds for a week. Paying customers notice nothing.
D · Engineering
How it’s built.
- 01
One contract first
Checkout, licensing server and plugin are built against one written contract. Changes go into the contract before they go into code.
- 02
Only signed answers count
Every licence answer is signed with Ed25519 and checked against the public key bundled in the plugin, within a 24-hour clock window. An unsigned error can never lock a site.
- 03
Webhooks that prove themselves
Stripe signatures are verified with a five-minute tolerance. With no secret configured, the endpoint refuses everything rather than trusting anything.
- 04
Limits that can’t be spoofed
Rate limits key on the connecting address, never on forwarded headers, so a request can’t pretend to be someone else.
Stack
Brand system
- Sentinel blue
#2F86FF - Bronze
#D39A63 - Ground
#08090C - Verified
#35C88A
E · Impact
By the numbers.
- 3
- Parts, one written contract
- 6
- Stripe events handled
- 7 days
- Grace if the server is unreachable
- 0
- Card details on our servers