At some point every plugin developer who’s actually selling something hits the same wall: you need someone else to touch your licenses, and the only tool you have is your own login.
Maybe it’s a support person who needs to reissue a lost key. Maybe it’s a co-developer on a plugin you didn’t build alone. Maybe you just want to go on holiday without being the only person who can unblock a customer. Handing over your account password isn’t a permissions system. It’s a liability.
Collaborators solves this properly: scoped, revocable access to a specific plugin, with per-action permissions enforced server-side, not just hidden in the UI.
The invite flow
From a plugin’s page, you open the Collaborators tab and enter an email address. That triggers an invite: a token gets generated, an expiry gets set seven days out, and an email goes to that address with a link to accept.
A few constraints are enforced at invite time, not just documented:
- Max 5 collaborators per plugin, counting pending invites and accepted members, so you can’t dodge the limit by leaving invites unaccepted forever.
- Max 10 invites per plugin per hour, to stop invite spam.
- You can’t invite yourself, and you can’t send a second invite to an email that already has a pending or accepted one for that plugin: you’ll get a 409 back, not a silent duplicate.
Until accepted, an invite is just a pending row with no access. Accepting is what actually creates the permission grant.
The four permissions
Every accepted collaborator gets four independent boolean flags, scoped to that one plugin:
createLicense: issue new keyseditLicense: change a license’s user, expiry, or IP limittoggleLicense: enable/disable a licensedeleteLicense: permanently remove a license
The default grant on invite is create, edit, and toggle on, delete off. That default isn’t arbitrary. It’s the set of actions a support person needs to do their job (issue a replacement key, fix a typo’d email, temporarily disable an abused key) without being able to do the one thing that’s actually destructive. You can flip any of the four at any time from the Collaborators tab, including turning delete on for someone you trust fully.
Where the permission check actually lives
This is the part that matters if you’re deciding whether to trust this with a real team: the checks aren’t a UI convenience, they’re on the license endpoints themselves.
When a request comes in against a license the requester doesn’t own, the server resolves whether they’re an accepted collaborator on that license’s plugin and what their permission flags are, before doing anything else:
- No accepted invite at all →
403 Forbidden, full stop, regardless of what they’re trying to do. - Accepted, but trying to edit fields (user, IPs, expiry) without
editLicense→403 Insufficient permissions. - Accepted, but trying to flip
disabledwithouttoggleLicense→403 Insufficient permissions. - Accepted, but calling delete without
deleteLicense→403 Insufficient permissions.
A collaborator with edit-but-not-toggle permissions who tries to disable a license in the same request that also edits its expiry gets rejected outright: the check runs per capability requested, not per request. That’s the difference between “the button is hidden” and “the server won’t do it even if you script around the UI.”
It works over the API too
Collaborators aren’t limited to the dashboard. A collaborator can generate their own API key and hit the same endpoints programmatically: the identical permission checks apply. A support tool built against the API by a collaborator without deleteLicense gets the same 403 a browser session would. And license limits are still counted against the plugin owner’s plan, not the collaborator’s, so adding a collaborator never costs them any of their own quota.
What it’s actually for
If you’re a solo developer with one plugin, you probably don’t need this yet. It starts mattering the moment any of these are true:
- You have a support person who shouldn’t also have your billing details.
- You co-develop a plugin and both of you need to issue licenses without sharing a login.
- You run multiple plugins and want a teammate scoped to just one of them, not all of them.
Set it up from any plugin’s Collaborators tab. See docs.mclicense.org for the full permission reference.