Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key,...
Validate purchase code, check for item update & support expiration, download newest version, lookup for user details, search for Envato item id & more
Envato Toolkit is a WordPress plugin designed to assist developers in managing Envato purchases. It provides a library with a visual interface to validate purchase codes, retrieve user details, check license expiration dates, and find update links for purchased plugins and themes.
This plugin is suitable for developers and authors who want to simplify the integration of Envato Market functionalities into their projects without dealing with the complexities of the official Envato Market plugin code.
Best for: This plugin suits developers looking to streamline Envato Market integration in their WordPress projects.
What it does well
Where it falls short
Envato Toolkit offers useful features for developers but has a low rating and limited updates, which may affect its reliability.
KestutisIT's own description of Envato Toolkit, lightly tidied.
It is a 3 files library + Visual UI, to validate the purchase codes of your customers, get details about specific Envato user (country, city, total followers, total sales, avatar), get his license purchase and support expiration dates, license type he bought, check for updates of purchased plugins and themes and get the download links for them.
Plus – this library has Envato Item Id search feature by providing plugin’s or theme’s name and author. So – yes, this is a tool you, as a developer / author, have been looking for months.
If you are looking for the library-only version to integrate into your plugin / theme, it’s on GitHub:
Envato Toolkit (Standalone)
The main purpose of this plugin is to help you to start much easier without having a headache trying to understand WordPress - Envato Market plugins code, that is the only one built by Envato, and has so complicated and unclear code, that you never get how it works (see example below).
When I tried to create plugin’s [Check for Update] and [Validate Purchase Code] feature-buttons in the plugin myself, and I saw the code of the WordPress - Envato Market plugin, I was shocked how badly it is written and how you should not to code.
For example – you would like to give an error message, if Envato user token is empty, which is a required string, i.e. – pAA0aBCdeFGhiJKlmNOpqRStuVWxyZ44. If you like K.I.S.S., PSR-2, D.R.Y., clean code coding standards and paradigms, you’d probably just have these five lines of code, so that every developer would get it:
$token = get_user_meta(get_current_user_id(), 'envato_token', TRUE);
if($token == "")
{
return new \WP_Error('api_token_error', __('An API token is required.', 'envato-toolkit'));
}
Now lets see how the same task traceback looks like in WordPress - Envato Market plugin:
[Api.php -> request(..)] Check if the token is empty:
if ( empty( $token ) )
{
return new WP_Error( 'api_token_error', __( 'An API token is required.', 'envato-market' ) );
}
[Api.php -> request(..)] Parse it from another string:
$token = trim( str_replace( 'Bearer', '', $args['headers']['Authorization'] ) );
[Api.php -> request(..)] Parse it one more time – this time from arguments array:
public function request( $url, $args = array() ) {
$defaults = array(
'timeout' => 20,
);
$args = wp_parse_args( $args, $defaults );
}
[Api.php -> download(..)] Transfer the token variable one more time – this time via params:
class Envato_Market_API {
public function download( $id, $args = array() ) {
$url = 'https://api.envato.com/v2/market/buyer/download?item_id=' . $id . '&shorten_url=true';
return $this->request( $url, $args );
}
}
[admin.php -> maybe_deferred_download(..)] Pass it again – this time get it to args array from another method call:
function maybe_deferred_download( $options ) {
$args = $this->set_bearer_args();
$options['package'] = envato_market()->api()->download( $vars['item_id'], $args );
return $options;
}
[admin.php -> set_bearer_args(..)] Wrap the token into multi-dimensional string array:
$args = array(
'headers' => array(
'Authorization' => 'Bearer ' . $token,
),
);
[admin.php -> set_bearer_args(..)] Pass the wrapped token one more time – this time get it from get_option:
foreach ( envato_market()->get_option( 'items', array() ) as $item ) {
if ( $item['id'] === $id ) {
$token = $item['token'];
break;
}
}
[admin.php -> get_option(..)] So what’s in this get_option? – Correct, another call to another method – get_options():
public function get_option( $name, $default = '' ) {
$options = self::get_options();
$name = self::sanitize_key( $name );
return isset( $options[ $name ] ) ? $options[ $name ] : $default;
}
[admin.php -> get_options()] Finally, after almost 10 steps in the tree, we are finally getting the original
WordPress method call, but now I’m getting confused again – what is that option_name variable here:
public function get_options() {
return get_option( $this->option_name, array() );
}
[envato-market.php -> init_globals()] Here is it is – the option name key name is… Oh wait…
No it is not here it. It is equals to another variable, who is is put
in another clean-up function – look like I’m keep seeing this for the 2 time in the tree – the sanitization of sanitization:
$this->option_name = self::sanitize_key( $this->slug );
[envato-market.php -> init_globals()] So the option name key name is the name of $this->slug.
Now lets see what is the value of $this->slug:
$this->slug = 'envato-market';
So it takes eleven (!) steps to understand one variable. And the whole code of that plugin is like that. The example above was the headache I had, until I realized that I must write a new Envato API Management Toolkit, instead of trying to use what Envato is giving, because otherwise I won’t get anything working ever.
And, I believe, that many other developers had the same issue when tried to create update check feature for their plugins or themes.
So instead of using that library for myself, I decided that I want to help all these developers to save their time, and I’m sharing this code with you. I’m releasing it under MIT license, which allows you to use this code in your plugin without any restrictions for both – free and commercial use.
Plus – I’m giving a promise to you, that this plugin is and will always be 100% free, without any ads, ‘Subscribe’, ‘Follow us’, ‘Check our page’, ‘Get Pro Version’ or similar links.
If you created in hi-quality code a valuable additional functionality to the library and you want to share it with everyone – I’m open here to support your efforts, and add your code to the plugin’s library, so that we all together make this plugin better for authors – the better is the plugin, the better plugins authors will make for their customers. The better quality products we will have on the internet, the happier people will be all over the world.
Finally – the code is poetry – the better is the plugin, the happier is the world.
The pseudo-code of example output of the plugin is this:
Other plugins for crypto and Web3 projects.
Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key,...
Crypto payment gateway for WooCommerce and Easy Digital Downloads. Accept 100+ coins: Bitcoin, Ethereum, BNB,...
ABC Crypto Checkout is a powerful cryptocurrency payment gateway for WooCommerce that lets you accept Bitcoin,...
Accept Bitcoin, Ethereum, and 300+ cryptocurrencies in WooCommerce using the official NOWPayments crypto payme...
Accept Bitcoin/USDT payments on your WooCommerce website. Crypto payments go directly to your wallet.
Instant Approval High Risk Merchant Gateway with instant payouts to your USDC POLYGON wallet using fiat to cry...