Member Avatar for Muhasaresa

Dear all,

I was wondering how to restrict people from going to a certain download link unless they have paid via PayPal. So the person must successfully pay before the restriction to the download link is removed.:icon_cheesygrin:

I would appreciate any help :icon_mrgreen:

Thank you,

Muhasaresa

  • 3 Contributors
  • 2 Replies
  • 116 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by ecom-host-guru

Dani AI

Generated

A concise, practical plan that builds on ’s note about PayPal and ’s comment about server-side checks: a reliable implementation uses a server-to-server confirmation from the payment provider, issues a short-lived single-use download credential, and serves files from non-public storage so direct URLs cannot be reused.

Recommended flow (high level):

  1. Accept payment and let the gateway send a verified server notification (PayPal Webhooks/IPN or equivalent). Do not rely on the buyer’s return page alone.
  2. On verified notification, create a downloadable entitlement tied to the order (order id, expiry time, max uses) and store only a hashed token/server-side record.
  3. Generate a single-use token or a presigned URL and send it by email or present it on a secure account page. The actual file is delivered via an authenticated handler that checks token, expiry, and usage count before streaming the file.
  4. On refunds/chargebacks, mark entitlements revoked so any existing tokens fail.

A simple token pattern (conceptual):

expires = now + 24h
token = base64url(HMAC_SHA256(secret, order_id + ":" + expires))
store(hash(token), order_id, expires, max_uses=3)
serve /download/<token> -> validate hash(token), order state, uses++, stream file

For storage and scale, use private object storage with presigned URLs or CDN signed URLs rather than exposing files in a webroot. See PayPal webhook docs for notification verification and AWS S3 presigned URL docs for safe file delivery: PayPal Webhooks and S3 presigned URLs.

Cautions: verify gateway signatures, log downloads, enforce rate limits, and invalidate entitlements on refunds. This pattern prevents simple link sharing and keeps control of access centrally.

Recommended Answers

All 2 Replies

Member Avatar for Dani

PayPal's API should be capable of this, but I'm not familiar enough with it. But it should definitely be possible through their merchant API.

Member Avatar for ecom-host-guru

I guess this depends on what system you are using for your online store and if they have support built in for this or if you can write your own coding etc. The way we have done this in the past is that there is a bit in the db for if payment has been completed or not, and you only display the download link if the bit is set. You set the bit when you get the notice from your payment gateway that the payment is completed. Make sure not to put the software in a regular web location or then anyone can share their link, use a script to download the software and during the download you also check the persons purchase information to make sure its valid before sending them the file. This way if the link is shared the person also needs to purchase information as well to download the file.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.