Skip to content
SoundSyncAudio software platform

Guide

Product Credential Lifecycle

How product-scoped credentials move from dashboard creation to package embedding, Test Connection, licensing, rotation, revocation, and recovery.

Start with getting startedExplore API docs

Generated native clients use public identity

HISEScript/custom HTTP use the standard product key/secret path. Current native HISE and JUCE packages identify the generated app/product through the supported hise-native or juce-native public-client contract and keep pluginSecret out of public configuration. Product identification is not customer ownership proof; do not substitute a developer token.

Dashboard credential surface

The product credential controls expose masked previews, active/revoked state, recovery actions, rotation, and revocation. Screenshots in public docs must remain sanitized.

SoundSync

Implementation path

Keep management calls in developer tooling and product credential calls in plugin runtime code.

  1. Choose the client model

    HISEScript/custom HTTP use the product-scoped key and secret. Generated native HISE/JUCE use their public app/product identity; do not add pluginSecret to native public configuration.

  2. Generate for the saved product

    Use its own Product ID, App ID, API base URL and environment. Keep server-only secrets out of generated native public configuration.

  3. Verify the product connection

    POST /api/plugin-connections/verify reads its JSON body. Send productId and appId, plus either pluginKey/pluginSecret or the generated native publicClient identity. Connectivity is not customer ownership.

  4. Test actual licensing

    Test activation, startup validation, explicit denial and deactivation with test accounts. For HISE and the current JUCE 0.7.3 package, test the selected Access grace period, expiry and disabled grace. JUCE requires a verified signed offline grant, not an editable cache. A working JUCE product does not need a separate manual-test history row to be considered operational.

  5. Rotate deliberately

    Regenerate affected packages after product credential changes. Test the replacement package before distributing it and never distribute server signing material.

SoundSync

Management behavior

These behaviors are taken from the current controller/service contract.

ActionEndpointBehaviorPackage action
Lost visible secretCall reveal-secret if the platform reports has_recoverable_secret.If PRODUCT_CREDENTIAL_SECRET_UNAVAILABLE is returned, rotate-secret and regenerate the package.
Secret exposed in logs/supportRotate-secret.Ship updated config/package. Treat older package builds as unable to authenticate once old credential is revoked.
Plugin key exposed or confused with old configRotate-key.The current platform rotates the pair, so copy both replacement values from the one-time reveal.
Credential revoked intentionallyCreate or ensure a new active credential before testing.Run Test Connection, then run serial/customer-login activation and validation smoke.
Generated HISE package still failsConfirm package was regenerated after rotation and copied into the active HISE project.Check App ID, plugin key preview, secret preview, Product ID, environment, and API base URL.

Legacy fallback boundary

Legacy developer-level plugin key creation and secret reveal are disabled with 410 responses. Any platform compatibility fallback is not the current public product credential model and should not be used for new integrations.