Docs /Download Tokens Dashboard →

Download Tokens

Secure, time-limited tokens that control access to your digital products and track download usage.

What are Download Tokens?

Download tokens are secure, unguessable random URLs that grant temporary access to your digital products. They are minted automatically — by store webhooks, by creating a purchase, or by the per-version Test Download button.

Example Token URL

https://continuata.io/download?token=8b5d3f2e-9c41-4a7b-b6d0-1e2f3a4b5c6d

Creating Tokens

Via Dashboard

  1. For a customer: go to Purchases → Create Manual Purchase — this mints the customer's download link and can email it automatically. The link is also available from the purchase row afterwards (Open Download Link).
  2. For yourself (testing): open the product's Versions tab and click Test Download on any version — a short-lived test link pinned to that exact version.

Via API

Create a purchase with POST /api/purchases (form fields — see the Custom API guide); the download link is minted as part of the purchase and emailed when sendEmail=true. Store webhooks (Stripe, Shopify, WooCommerce, FastSpring, VibraCart Pro) do the same automatically.

Token Lifetime

Test Download links expire 2 hours after creation. Customer purchase links are valid for 48 hours at a time — and they self-heal: an expired link refreshes automatically when the customer opens it. This is intentional — links are a short-lived courtesy, not a long-term access grant.

For long-term access, use the customer portal: Customers don't need to keep token URLs around. continuata.io/my lets them re-mint a fresh download link for any of their purchases at any time, indefinitely. Always link to the portal in your post-purchase emails.

Token Security

Tokens are random opaque strings — there's nothing in the token itself for an attacker to forge against; it either matches a stored entry or it doesn't.

  • Short expirations enforced server-side (48h purchase links, 2h test and rehearsal links)
  • Customer purchase links always deliver the product's currently active version; Test Download and beta invite links pin the exact version they were created from
  • Always serve token URLs over HTTPS — never log them in plaintext

Rate Limits

New download starts on a link are throttled: a 60-second cooldown per link and per IP, and at most 20 fresh download sessions per link per hour (HTTP 429 beyond that). Resuming an in-progress download is exempt — a resume within 24 hours continues the existing session. The /redeem serial-code page applies the same style of protection: a human-verification check plus a 60-second per-IP and per-code cooldown after a successful redemption.

Best Practices

✓ Recommended

  • Always include a link to continuata.io/my in post-purchase emails
  • Mint a fresh token per delivery — don't try to share one across customers
  • Use HTTPS everywhere — never log token URLs in plaintext
  • Treat short expirations as a feature, not a limitation

✗ Avoid

  • Sharing tokens publicly or in forums
  • Caching token URLs as if they were permanent download links
  • Using one token for multiple customers
  • Storing tokens in plain text logs or analytics events

Automation Ready: Set up automated token generation via platform integrations or build custom workflows with our API.