Deliora — Self-Hosted Digital Product Store, Delivery & License Keys
A self-hosted digital product store, delivery, and license-key manager — a Gumroad alternative you own.
The problem it solves
Platform storefronts take a cut of every sale, plus payment fees, for as long as you keep selling through them — for what amounts to hosting a product page and a download link. Sell steadily and that cut compounds into real money every year, year after year.
- Your customer list lives on their platform, not yours
- Your checkout can be suspended by their risk team at any time
- Your "store" is a subdomain you don't control
What you get
Public storefront & checkout hand-off
Build landing pages with screenshot galleries and tiered pricing, then hand checkout off to Lemon Squeezy or a Stripe payment link so card data never touches your box.
Idempotent webhook fulfillment
Orders are fulfilled from the provider's webhook keyed on its order reference, so a duplicated webhook can never double-issue a license.
Secure, expiring download links
Files live outside the web-served tree, reachable only via single-purpose tokens with configurable expiry and max uses, claimed atomically.
License-key manager with activation API
Keys support per-domain activation limits, revoke/reissue, and a JSON check/activate API your own apps can call.
Passwordless buyer portal
Buyers get a magic-link portal showing every order, key, and re-download link — no buyer passwords to support.
Demo payment mode
A built-in simulated checkout exercises the entire loop — storefront, checkout, webhook, license, download, and email — with no provider account.
Installable mobile app (PWA)
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Own It 2.0 — API, 2FA, backups, dark mode
Deliora 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
- Email notifications through your own SMTP
- CSV import with a mandatory dry run
- One-click backups
- Dark mode
Own It 3.0 — works for your AI, not just for you
Agents connect over MCP to list orders, pull revenue stats and — with an admin key — mint deal codes, under the same guards a person faces; there are deliberately no refund, price-edit or customer-email tools. A support seat sees orders, customers and licenses without the power to wipe or configure the shop.
- Roles with email invitations and a last-admin guard
- Append-only audit trail across browser, API and agent
- Printable PDFs
- Your logo and colours throughout
- Scheduled backups with a guided dry-run restore
- Optional single sign-on (OIDC)
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Screenshots
Honest limitations
- Payments run through a merchant-of-record or Stripe redirect — there is no on-box card processing (by design)
- License signing and payment-webhook signature verification ship as demo-mode modules; real providers activate once the production signature module and keys are configured, and until then real-provider webhooks are rejected fail-closed
- No marketplace/multi-vendor features, no affiliate tracking, no coupons (v1)
- No recurring-subscription billing engine — one-time purchases with license tiers
- Single admin login (buyers use passwordless magic links)
2-minute web installer; PHP 8+ with MySQL or SQLite, shared-hosting friendly.
Covered in these guides
The honest walkthrough: what self-hosting actually requires, what the 2-minute web installer does, and what you are (and are not) signing up to maintain.
What actually changes — good and bad — when you stop renting the store layer and self-host it. Every platform fee cited from live pricing pages.
What deal marketplaces actually require from a vendor — 1,000+ redemption codes, an instant redemption page, refund-safe fulfillment — and how to run all of it self-hosted. We fulfilled our own AppSumo listing this way.
Every tracked vendor has a headline price and a second one underneath it. Processing rates that change with your plan, per-transaction fees, volume caps, and a monthly charge to keep your own records. All quoted, all dated.
Frequently asked questions
Where does the money actually flow?
Directly from your buyer to your Lemon Squeezy or Stripe account. Deliora never holds funds and never sees card numbers — it fulfills orders from the provider's webhook.
Are my product files safe?
Deliverables sit in a directory denied by the web server. The only path to them is a random token that expires, has a use cap, and is claimed with an atomic database update.
Will this run on shared hosting?
Yes. PHP 8+ with pdo and fileinfo, MySQL or SQLite, Apache mod_rewrite. The installer takes about two minutes.
Can my own apps verify licenses?
Yes — the license API's check and activate endpoints return validity, tier, and activations left. Activation is idempotent per domain, so reinstalling on the same site never burns a slot.
What about VAT/sales tax?
If you use a merchant-of-record provider like Lemon Squeezy, they handle it as the seller of record. With Stripe payment links, tax settings live in Stripe; Deliora records what was sold and to whom.