Private Invitations

Invite specific people to install a private plugin with an email-bound, single-use link that expires in 7 days. No review, no marketplace listing.

Private plugins are owner-installable by default. Invitations let you extend install access to specific people — without publishing the plugin or exposing it in the marketplace. Each invitation is bound to one email, works once, and expires after 7 days.

Quick path

Set your plugin's distribution to private.
Switch its access mode to invitation.
Create an invitation for a person's email — you get a shareable install link.
Send the link to that person. They sign in with the invited email and install the plugin into their active store.

Access modes

A private plugin has one access mode, stored as private_access_mode:

Mode	Who can install	Default
`owner_only`	Only you, the plugin owner	Yes
`invitation`	You, plus anyone holding a valid invitation for their email	No

Access modes apply to private plugins only. Switching to invitation mode is an explicit action — it is never turned on automatically. You can switch back to owner_only at any time; existing links stop resolving because the plugin is no longer in invitation mode.

Creating an invitation

From your plugin's detail page in the Developer Portal:

Enter the invitee's email address.
Create the invitation.

You receive a shareable install link that looks like:

https://app.whatalo.com/install/XX-XXXXXXXX?invite=<token>

The link is shown once. Copy it before leaving the page.
The raw token lives only inside this link — the platform stores only a hash of it, so it cannot be recovered or displayed again later.
Sharing is manual: send the link to the invitee yourself (email, chat, etc.). The platform does not send it for you.

How an invitee redeems it

When the invitee opens the link:

Sign in — if they are not authenticated, they are sent to login and returned to the link afterward.
Email match — the account they sign in with must use the exact email the invitation was created for. A valid link alone is not enough.
Active store — the plugin installs into the invitee's active store. There is no store picker.
Paid plan — like any marketplace install, the target store must be on a paid plan. Free-plan stores are blocked until they upgrade.

On success, the plugin is installed and an API key is revealed once. If any check fails, the install is refused with a clear message and the invitation is not consumed.

Invitation lifecycle

Each invitation has exactly one derived status:

Status	Meaning
`pending`	Usable — not yet redeemed, revoked, or expired
`consumed`	Redeemed once. Single-use; cannot be reused
`revoked`	Cancelled by the owner before it was used
`expired`	Past its 7-day window

Rules that always hold:

Single-use. A successful redemption consumes the invitation. A second attempt with the same link fails.
7-day expiry. Every invitation expires 7 days after creation.
Email-bound. An invitation only installs for the email it was created for.
Revocable. You can revoke a pending invitation. A consumed invitation cannot be revoked; revoking an already-revoked one is a no-op.

Managing invitations

From the plugin detail page you can:

List every invitation for the plugin, newest first, with its current status.
Revoke a pending invitation to cancel access before it is used.

Revoking does not uninstall the plugin from stores that already redeemed a different invitation — it only prevents the revoked link from being used.

Distribution — private vs public and access modes
Review Process — why private plugins skip review