Deliora — Self-Hosted Digital Product Store, Delivery & License Keys
A self-hosted digital product store, delivery, and license-key manager — a Gumroad alternative you own.
The problem it solves
Platform storefronts take a cut of every sale, plus payment fees, for as long as you keep selling through them — for what amounts to hosting a product page and a download link. Sell steadily and that cut compounds into real money every year, year after year.
- Your customer list lives on their platform, not yours
- Your checkout can be suspended by their risk team at any time
- Your "store" is a subdomain you don't control
What you get
Public storefront & checkout hand-off
Build landing pages with screenshot galleries and tiered pricing, then hand checkout off to Lemon Squeezy or a Stripe payment link so card data never touches your box.
Idempotent webhook fulfillment
Orders are fulfilled from the provider's webhook keyed on its order reference, so a duplicated webhook can never double-issue a license.
Secure, expiring download links
Files live outside the web-served tree, reachable only via single-purpose tokens with configurable expiry and max uses, claimed atomically.
License-key manager with activation API
Keys support per-domain activation limits, revoke/reissue, and a JSON check/activate API your own apps can call.
Passwordless buyer portal
Buyers get a magic-link portal showing every order, key, and re-download link — no buyer passwords to support.
Demo payment mode
A built-in simulated checkout exercises the entire loop — storefront, checkout, webhook, license, download, and email — with no provider account.
Pricing — one-time, yours forever
Available soon — get notified
Checkout isn't open yet. Leave your email and we'll send one note the moment Deliora — Self-Hosted Digital Product Store, Delivery & License Keys can be purchased — nothing else.
Screenshots
Honest limitations
- Payments run through a merchant-of-record or Stripe redirect — there is no on-box card processing (by design)
- License signing and payment-webhook signature verification ship as demo-mode modules; real providers activate once the production signature module and keys are configured, and until then real-provider webhooks are rejected fail-closed
- No marketplace/multi-vendor features, no affiliate tracking, no coupons (v1)
- No recurring-subscription billing engine — one-time purchases with license tiers
- Single admin login (buyers use passwordless magic links)
2-minute web installer; PHP 8+ with MySQL or SQLite, shared-hosting friendly.
Frequently asked questions
Where does the money actually flow?
Directly from your buyer to your Lemon Squeezy or Stripe account. Deliora never holds funds and never sees card numbers — it fulfills orders from the provider's webhook.
Are my product files safe?
Deliverables sit in a directory denied by the web server. The only path to them is a random token that expires, has a use cap, and is claimed with an atomic database update.
Will this run on shared hosting?
Yes. PHP 8+ with pdo and fileinfo, MySQL or SQLite, Apache mod_rewrite. The installer takes about two minutes.
Can my own apps verify licenses?
Yes — the license API's check and activate endpoints return validity, tier, and activations left. Activation is idempotent per domain, so reinstalling on the same site never burns a slot.
What about VAT/sales tax?
If you use a merchant-of-record provider like Lemon Squeezy, they handle it as the seller of record. With Stripe payment links, tax settings live in Stripe; Deliora records what was sold and to whom.
See it running before you buy
The live demo is being prepared — check back shortly.
Demo — coming soon