FileFreightTechnical FAQ
How does seller authentication work?
Session-cookie based. Signing up or logging in (on the site or via
POST /api/auth/register / POST /api/auth/login) sets
an httpOnly session cookie (secure +
SameSite=Lax in production); the session id is regenerated on
every login. Passwords must be at least 12 characters and are hashed with
Argon2id. Auth endpoints are rate-limited to 10 requests/minute per IP, and
login failures return an identical response whether the email is unknown or
the password is wrong. Optional TOTP two-factor authentication is available
via POST /api/auth/2fa/setup and /confirm.
What are the API rate limits?
- Global: 100 requests/minute per IP
- Auth endpoints: 10/minute per IP (2FA verification: 5/minute)
- Buy-page checkout: 30/minute per IP
- License validation: 20/minute per IP
- Download links: 30/minute per IP
How are webhooks verified?
Stripe sends the events of every connected account to one Stripe Connect endpoint, which verifies the Stripe signature over the raw request body with a 300-second timestamp tolerance. Missing signatures and failed verifications are rejected. Each event is matched to a seller by the Stripe account it came from, never by anything in the payment itself. Events are processed idempotently — duplicate deliveries are ignored.
Where are my files stored?
In private S3-compatible object storage. Buyers never get a bucket path:
downloads are served through tokenized links (/d/<token>)
backed by 60-second presigned URLs, honoring your per-product download limits
and expiry.
What’s the maximum file size?
500 MB per upload.
How does the free-plan 5% fee work?
On Free, Stripe deducts 5% of each sale from the payment as an application fee and the rest settles to your Stripe account. On Pro there is no fee. If you refund a sale, the fee on the refunded amount comes back to you. See the fee disclosures.
Do you touch my money?
No. Payments are processed by Stripe on your account. FileFreight never sees card details and never holds seller funds; the only money it receives is the Free-plan fee, which Stripe deducts for it.
What happens when a buyer refunds?
Stripe reports the refund to FileFreight, and the buyer’s download entitlement and license keys are revoked automatically. Previously downloaded files can’t be un-downloaded, but stamped PDFs remain traceable to the buyer.