Plans & WHMCS products

A plan defines the commercial Managed Authentication product: limits, feature gates, and pricing. Sync each plan to a WHMCS product to make it orderable.

Tab: Plans & Products · Seed plans: Free / Dev / Pro

1. What a plan carries

Plans are managed under Addons → ImpulseAuth → Plans & Products. A plan record holds everything the module needs to price, gate, and enforce a tier:

• Tier (Free, Dev, or Pro) and display name. The tier decides the feature set (see section 3).
• MAU limit (monthly active users) and project count (shown to customers in the product description and client area).
• OAuth provider cap and custom-domain count.
• Plan switches: MFA (TOTP), BYO SMTP, anonymous sessions, leaked-password detection, and per-project audit logs.
• A rate-limit zone label.
• Monthly/annual price and the mapped WHMCS product.

All limits and gates live on the plan record. The WHMCS product’s only module option is which plan it maps to — the product does not carry limits of its own.

2. The seeded plans

Activation seeds three example plans. Rename, reprice, add, or retire them — the values below are illustration defaults, not a mandated catalog.

Plan	Monthly	Max MAU	Projects	OAuth	Notable features
Free	$0	5,000	2	1	Email/password and one OAuth provider.
Dev	$9	25,000	5	All	All OAuth, MFA (TOTP), custom redirects, custom claims, auth hooks, phone, roles, abuse controls, identity linking.
Pro	$19	100,000	Unlimited	All	Everything in Dev plus custom JWT secret, BYO SMTP, anonymous sessions, leaked-password detection, audit logs, enterprise SSO, SCIM, OAuth issuer/apps, and one custom domain.

Set your own pricing

These prices are seed defaults for illustration ($90 and $190 a year for Dev and Pro). Set your real monthly and annual prices on the plan: syncing writes them into the WHMCS product for every currency (converted at each currency’s exchange rate), turns the other billing cycles off, and replaces any pricing edited directly on the product.

3. Feature gates and the license

What a customer can actually use is the intersection of the plan tier and your operator license. Dev and Pro plans add MFA, all OAuth providers, custom redirects and claims, auth hooks, phone sign-in, roles, abuse controls, and identity linking; Pro alone adds the OAuth/OIDC issuer, anonymous sessions, leaked-password detection, audit logs, BYO SMTP, custom JWT secret, enterprise SSO, SCIM, and custom domains. A plan can advertise enterprise SSO, but it only lights up when a valid IAUTH- license is active. There is a single licensed edition of ImpulseAuth:

License state	Control planes	Plans	Feature set
Licensed (IAUTH-)	Unlimited	Unlimited	Full feature set enabled.
Development (IAUTHDEV-)	2	3	Full features except custom domains, for testing. Developer keys aren’t sold with the module.
No key	1	3	Base features only — the licensed features listed above stay off.

License state is validated and cached through ImpulseCore and shows as a pill in the admin header and under Diagnostics → License.

4. Edit limits and features

1. Open Plans & Products and edit a seed plan or create a new one.
2. Set the MAU limit, project count, OAuth cap, and custom-domain count for the tier.
3. Pick the tier, and toggle the plan switches (MFA, BYO SMTP, anonymous sessions, leaked-password detection, audit logs).
4. Set the rate-limit zone and the annual/monthly price.

Package changes re-render the project

When a customer upgrades or downgrades, the module re-renders the project’s environment from the new plan tier — limits and feature gates move with the package change.

5. Sync to WHMCS products

Each plan becomes an orderable WHMCS product by syncing it.

1. Open a plan and click Create WHMCS product (Re-sync WHMCS product once it exists), or click Sync all active plans to WHMCS on the Plans tab.
2. Open the generated WHMCS product’s Module Settings and confirm the server module is ImpulseAuth and the Plan dropdown matches the plan slug.
3. Check the synced pricing, and confirm visibility and the welcome email. An inactive plan’s product is hidden.

The plan is the only module option

On the product’s Module Settings, the plan dropdown is the whole configuration — every limit and feature gate is read from the plan record it points at.

6. Optional: region at checkout

Add a Region configurable option or custom field on the WHMCS product so customers pick placement at order time. An explicit region request is a hard placement guarantee — if the chosen region has no capacity, the order fails loudly rather than being placed elsewhere. Without a region choice, ImpulseAuth places the project into the least-loaded eligible control plane.

7. MAU & quota enforcement

Two Core crons keep usage aligned to the plan:

• poll_mau (hourly) counts distinct users active in the last 30 days per project and caches the value; the Dashboard and Customers tabs surface it.
• enforce_quotas (hourly) compares that count with the plan’s MAU limit. A project over the limit is flagged as over quota and the customer receives the MAU Limit Reached email; the flag clears once usage drops back under the limit. Over-quota projects are not suspended — suspension for billing stays with WHMCS.

Each control plane applies one shared per-client request limit at its web front end; the plan’s rate-limit zone is stored with the project as metadata.