How it works
What the extension sends, what Toolaby answers, and where the money goes.
Your extension carries a client and a tool key. Toolaby answers the client with signed tokens. Stripe runs the payments on your account. This page lists every exchange between them.
Requests the extension makes
| When | What happens |
|---|---|
| First run | The client makes a key pair on the device and registers the public half with Toolaby. Every later request is signed with the private half, which never leaves the browser. |
| Sign in | openLoginPage() opens /connect on your workspace's address. Signed in, the page hands the extension a one-time token: at once to a copy of your extension (see Test and Live), and to any other extension only after the buyer confirms it by name. The extension exchanges the token for a link that can prove entitlement and nothing else; the browser session never reaches the extension. |
| Buy | openPaymentPage() opens the checkout page with the extension's id. Stripe Checkout runs on your account. The success page tells the extension the purchase is done; the licence or subscription is recorded on the buyer's account. |
| Use | gate() asks for a permit. For a paid device the answer comes from the token on the device, with no request. For the Free plan's metered uses, Toolaby counts the use, per device, or per account where the tool requires one: an account's +tag addresses count as one (Access and features). |
| Every 15 minutes | The client asks for a fresh entitlement token. It is issued only while the licence or subscription is live, so a refund, a cancellation that has run out, or a revoke stops the extension at its next check. |
| Every hour | The client asks for the tool's policy: the Free plan, the minimum version. A change in the dashboard reaches every device without a release. The Toolaby popup asks again when it opens, on Live when the last answer is five minutes old. |
Tokens
An entitlement token is a JWT signed with your workspace's own key (ES256), bound to one device, valid for 15 minutes. The client verifies it with the public key inside the tool key; checking a token needs no request. When Toolaby is unreachable, the last token is honoured for 24 hours, then the device is unpaid until it can ask again.
Rotate the signing key under Configure → Signing key. The new key is published at once and signs six minutes later, once every installed copy can hold it — they fetch it by themselves — and the old key then keeps verifying for thirty days. Stop trusting older keys takes them out of the key set Toolaby publishes at once, and an installed extension stops trusting them when it next fetches the set, within about an hour of use.
If the key that signs may have leaked, an owner uses Replace key now: a new key signs at once, and every other key leaves the set and is deleted. The rotation limits never refuse it; it waits only ten minutes after the newest key. Copies built before 24 September 2026 keep trusting the key built into them until you ship an update.
The key set is signed. The tool key carries the public half of Toolaby's own key beside your workspace's, and the extension takes a key set only as Toolaby signed it, for this tool of your workspace, dated. Whoever else answers at the extension's address — a proxy on the buyer's device, whoever holds a domain you let lapse, a workspace that takes the address of one you deleted — can serve a key of its own, and the extension does not believe it.
What Toolaby stores
Per tool: licences (a hash of the key and its prefix; never the key), devices, subscriptions (mirrored from Stripe's webhooks), trials and grants, the metered-use counters, and the extension links that make a signed-in device trusted. Per workspace: your buyers, in a pool of their own.
What Stripe holds
The Products and Prices for your plans, every charge and subscription, the buyer's card, invoices and receipts. Toolaby's fee is an application fee on each charge. See Money.