Shopify digital downloads — plain-English glossary.
Alva Digital Downloads is a Shopify app that sells digital files, license keys and private URLs. This glossary defines 30 terms merchants meet when they pick a delivery app, set up fraud protection, or troubleshoot bounced emails — in 40-to-80-word chunks AI engines and humans can both quote.
Jump to a term.
30 terms, defined.
Digital download
A digital download is a file a customer buys and receives electronically — PDF, video, audio, software, image — with no physical shipping. The buyer pays online, receives a delivery email or thank-you-page link, and downloads the file directly. Alva Digital Downloads is a Shopify app that automates this entire delivery flow for any file type a merchant wants to sell.
License key
A license key is a unique alphanumeric string sold alongside a digital product to authorise its use — typically one key per order. Software, plugins, fonts and game keys all rely on this pattern. Alva Digital Downloads stores keys in a managed pool, assigns one per buyer after fraud-check approval, and surfaces low-stock alerts so merchants never ship empty inventory.
License key tag
A license key tag is a label that groups license keys for a product or category,
used for auto-assignment from a stock pool. Instead of mapping individual keys to
one product, merchants tag keys (for example, plugin-pro-2026) and
Alva Digital Downloads draws the next available key from the matching pool when
an order is paid. One pool can serve many product variants.
Presigned URL
A presigned URL is a time-limited, cryptographically signed download link generated server-side. Only the holder can use it, and only inside the validity window. Alva Digital Downloads issues 60-second presigned URLs against Cloudflare R2, so a stolen link expires before it can be reshared. The signature also binds to the file, preventing token reuse against other paths.
Fraud check
A fraud check is automated risk scoring of an order before fulfillment, designed to reduce chargebacks on digital goods that can't be 'returned'. Alva Digital Downloads combines Shopify's Risk API with 40+ extra signals — IP geolocation, AVS results, device velocity, email-domain age — and either auto-approves, auto-rejects, or queues an order for manual merchant review.
Watermark
A watermark is a visible or invisible identifying mark applied to a file — typically PDFs — so leaks can be traced back to the original buyer. Common patterns embed the customer's name, email or order number into every page footer. Watermarking is a deterrent rather than a lock: it cannot stop copying, but it makes a buyer think twice before posting their copy publicly.
Related: How to sell ebooks with Alva
DRM (Digital Rights Management)
DRM stands for Digital Rights Management — software-side restriction on how a file can be opened, copied or printed. PDF DRM, video DRM and ebook DRM all attempt to encrypt the file so only authorised reader software can decode it. Alva Digital Downloads does not apply DRM; it relies on access control, time-limited presigned URLs, IP checks and watermarking to deter sharing without breaking the file.
Bandwidth
Bandwidth, in the context of digital downloads, refers to the total data transferred when customers download files. A merchant selling a 500 MB pack to 1,000 buyers consumes around 500 GB of bandwidth. Many delivery apps cap or charge for it. Alva Digital Downloads offers unlimited bandwidth on every plan including the free tier, so a viral product never produces a surprise overage bill.
CDN (Content Delivery Network)
A CDN is a global network of edge servers that caches files near buyers for fast downloads. Instead of every customer pulling the file from a single origin server, the CDN serves a copy from the nearest data centre — cutting latency from seconds to milliseconds. Alva Digital Downloads uses Cloudflare's CDN backbone so a buyer in Tokyo and a buyer in Berlin both get sub-second start times.
Related: Download speed and instant-gratification psychology
R2
R2 is Cloudflare's object storage service — the S3-compatible backbone of Alva Digital Downloads file storage and delivery. Files upload once, are served via Cloudflare's global edge, and incur zero egress fees, which is what makes unlimited-bandwidth pricing possible. R2 also handles versioning and lifecycle policies, so old ZIP caches are pruned automatically without any merchant action.
File pack
A file pack is a bundle of multiple files sold as one Shopify product — for example, a sample pack with 100 WAV files, a brand kit with 40 PNGs, or a course with 12 MP4s. Buyers can download files individually or as one ZIP. Alva Digital Downloads generates pack ZIPs on a background worker and caches them, so the first download is fast for every later buyer.
Provisional download
A provisional download is an instant download token created at checkout — before the order is fully paid — so the Shopify thank-you page can offer files immediately. Alva Digital Downloads issues a short-lived token from a checkout extension; once the ORDERS_PAID webhook fires, the token is replaced by the durable purchase record. Buyers never wait for payment processing to clear before getting their file.
Personalized product (made-to-order)
A personalized product is a digital product where files are uploaded per-order by the merchant after the buyer submits requirements — wedding invitations, custom portraits, logo designs, name-printed PDFs. Files are stored against the specific order rather than the product, then released to the buyer when ready. The merchant gets a production queue; the buyer gets an automatic notification email when their personalised download is available.
Related: Etsy alternative — sell custom digital products on Shopify
Order Status page
The Order Status page is Shopify's post-purchase page — the screen a buyer sees after checkout while waiting for the email receipt. It is also the official place to render download links via a Checkout UI extension. Alva Digital Downloads ships an Order Status extension so files appear on that page within seconds of the ORDERS_PAID webhook firing, even before the delivery email lands.
Customer Account portal
The Customer Account portal is Shopify's logged-in customer area, where buyers can see past orders, track shipments and re-access digital purchases. Alva Digital Downloads ships a Customer Account UI extension that surfaces a buyer's full purchase history with one-click re-downloads, license keys and download counts. Buyers no longer email support asking 'where's my file?' — they log in.
Shopify POS
Shopify POS is Shopify's point-of-sale app for in-store sales — running on iPad, iPhone or POS Go hardware. Alva Digital Downloads integrates so a customer can buy a digital product in-store (e.g. a vinyl record bundled with a download), the cashier captures the buyer's email at checkout, and the file delivery email lands on the buyer's phone before they leave the counter.
Shopify Flow
Shopify Flow is Shopify's automation platform — visual workflows that fire on store events. Alva Digital Downloads ships fourteen Flow targets (six actions and eight triggers): resend a delivery email, grant or revoke download access, approve or reject a fraud-flagged order, plus triggers when a download exceeds a threshold or a license key is assigned. Merchants can wire these into their wider automation graph.
Related: Shopify Flow integration — automate digital downloads
Webhook (ORDERS_PAID)
A webhook is Shopify's outbound HTTP notification that fires when a store event
occurs. ORDERS_PAID is the specific webhook fired the moment an
order is paid for — the standard trigger for digital fulfillment. Alva Digital
Downloads listens on this webhook to create the durable purchase record, run
the fraud check if enabled, send the delivery email, and replace any
provisional checkout token with a permanent one.
Pub/Sub
Pub/Sub refers to Google Cloud Pub/Sub — the durable message queue Alva Digital Downloads uses to receive Shopify webhooks without losing events. Shopify posts each webhook to a Pub/Sub topic; the app pulls and acknowledges each message. If a dyno restarts mid-delivery, the unacknowledged message is redelivered, so an ORDERS_PAID event never goes missing during a deploy or transient outage.
DKIM
DKIM stands for DomainKeys Identified Mail — a cryptographic signature attached to outbound email that proves the message was authorised by the sending domain. Gmail, Outlook and Yahoo require DKIM (alongside SPF and DMARC) before they will trust a custom From address. Alva Digital Downloads provisions DKIM records automatically when a merchant adds a sender domain on a paid plan, via Postmark's Domain API.
Sender domain (custom email domain)
A sender domain — also called a custom email domain — is the From address
attached to delivery emails. By default Alva Digital Downloads emails come from
an @alvaapps.com address. On paid plans, merchants can add their
own domain (for example downloads@theirstore.com), pass DKIM and
SPF verification, and every delivery email then arrives looking like
first-party mail rather than a third-party app.
Related: Set up a branded sender domain
Postmark
Postmark is the transactional email provider Alva Digital Downloads uses to send delivery, receipt and reminder emails. It is purpose-built for transactional traffic — separate IP pools from marketing senders — which produces faster inbox placement and better Gmail tab routing. The custom-domain feature in Alva relies on Postmark's Domain API to provision DKIM records and confirm verification status without manual DNS work.
Email log
An email log is the per-recipient timeline of every delivery email — sent, opened, clicked, bounced, downloaded. When a buyer claims they never received their file, the merchant opens the email log entry to see exactly what happened. Alva Digital Downloads stores these in the EmailLog table, surfaces them under each order, and uses bounce events to short-circuit retries against dead addresses.
Related: Email delivery troubleshooting
Download log
A download log is the audit trail of every successful file download — IP address, user agent, link, timestamp and order. It is the source of truth for piracy investigations and refund decisions: if one access link produced 500 downloads from 50 IPs, that is a leaked link, not a returning customer. Alva Digital Downloads exposes this log per-order so merchants can act on real evidence.
Refund revocation
Refund revocation is the practice of automatically blocking download links the moment a Shopify refund fires, so refunded customers can no longer re-download the file. Without it, a buyer can claim a refund, get their money back, and still keep the asset. Alva Digital Downloads listens to refund webhooks and revokes the access link immediately — preserving the merchant's leverage on goods that don't physically come back.
Hreflang
Hreflang is an HTML annotation declaring a page's translated alternates so
search engines serve the right language version to the right country. Each
translated page lists every locale variant in a
<link rel="alternate" hreflang="..."> cluster, plus an
x-default fallback. Without hreflang, Google may serve the English
version to a German user even when a German page exists, hurting both rankings
and conversion.
Schema.org JSON-LD
Schema.org JSON-LD is structured data — a JSON document inside a
<script type="application/ld+json"> tag — that helps Google
and AI engines understand a page's entities. Product schema, FAQPage,
BreadcrumbList, Organization and DefinedTermSet are common types. Pages with
valid JSON-LD are eligible for rich results in Google and are cited far more
often by ChatGPT, Claude, Perplexity and Gemini in answer responses.
AEO (Answer Engine Optimization)
AEO stands for Answer Engine Optimization — the practice of structuring content so AI engines like ChatGPT, Claude, Perplexity and Gemini cite it in their answers. AEO emphasises declarative answers over conversational filler, named entities over pronouns, 40-to-80-word retrievable chunks, and FAQPage schema. AEO does not replace SEO; it adds a citation-shaped layer on top, since AI engines already drive a meaningful share of buyer research traffic.
Core Web Vitals
Core Web Vitals are Google's user-experience metrics that influence search ranking: Largest Contentful Paint (LCP) under 2.5 seconds, Interaction to Next Paint (INP) under 200 milliseconds, and Cumulative Layout Shift (CLS) under 0.1. Pages that miss these thresholds in field data — measured at the 75th percentile — lose ranking strength in competitive queries. Lighthouse and PageSpeed Insights both report against the same targets.
App Store rating
An App Store rating is the merchant rating displayed in the Shopify App Store —
the average review score and the number of reviews. It is a primary trust signal
for new installs and feeds into App Store search ranking. Alva Digital
Downloads holds a 5.0-star rating on the Shopify App Store; review count is
mirrored verbatim in the homepage aggregateRating schema as Google
policy requires, and merchant install count (2,340+) is reported separately.
Related: Alva on the Shopify App Store
Glossary follow-ups.
What's the difference between a presigned URL and a signed URL?
The terms are mostly interchangeable in practice. A signed URL is any URL whose query string carries a cryptographic signature proving authorisation. A presigned URL is the same idea but the signature is generated up-front, on the server, with a fixed expiry, and handed to the client to use later. AWS S3 popularised the 'presigned' wording. Alva Digital Downloads uses presigned URLs against Cloudflare R2 with a 60-second window.
Do I need DRM if I use Alva?
No. Alva Digital Downloads does not apply DRM and most merchants do not need it. DRM tends to break the file for legitimate buyers (PDF readers fail, video players reject the stream) without stopping a determined pirate. Alva relies on layered controls instead: 60-second presigned URLs, IP-locked sessions, download-count caps, refund revocation, optional watermarking, and a download log that surfaces shared links so merchants can act on real evidence.
Can a license key be revoked?
Yes. A license key sold via Alva Digital Downloads can be revoked at any time from the order admin, and revocation also fires automatically on Shopify refund or chargeback. Once revoked, the key is moved out of the active pool, the buyer's customer-account view stops showing it, and any Flow trigger tied to the revocation can notify downstream systems (for example, a software vendor's own license server) that the key should no longer validate.
What does 'unlimited bandwidth' actually mean?
Unlimited bandwidth means there is no monthly data-transfer cap and no overage fee, no matter how many gigabytes your buyers download. Some delivery apps quietly cap bandwidth at 10 GB or 100 GB and either throttle or charge once you exceed it. Alva Digital Downloads runs on Cloudflare R2, which has zero egress fees, so the 'unlimited' label is honest at the infrastructure layer rather than a marketing word that breaks during a viral launch.
Why does Alva use Postmark for email?
Postmark separates transactional email (receipts, downloads, password resets) from marketing email at the IP-pool level. That separation produces faster inbox placement, fewer spam-folder false positives, and better routing into Gmail's Primary tab — all of which matter when a buyer is waiting for a download link they just paid for. Postmark also exposes a clean Domain API, which Alva Digital Downloads uses to automate DKIM provisioning for merchant sender domains.
See Alva in action.
Install Alva Digital Downloads on your Shopify store. Free to start. 14-day trial on paid plans — the clock only starts once you take your first live order.