How a plugin connects, and why it is safe

Client sites only ever make outbound HTTPS calls to the hub, so there is no IP allow-listing and nothing to open up on either end.

• Each product has one product key, shipped inside the distributed plugin. It permits registration and nothing else.
• On first use a site self-registers with that key and receives its own private site token.
• Every call after that authenticates with the site token, so one customer can never read another’s tickets.

No admin credentials are ever shipped inside a distributed plugin.