API and signed connector requests

What to do

1. Normal account traffic uses /api/v2/pair and signed /api/v2/stores/{id} routes for entitlements, coarse health and update tickets. Current Free and Pro plugins do not request contact quotas or report aggregate contact usage.
2. WordPress admin requests use /recoverkit/v2/ui/ with the current WordPress session, REST nonce and the required recovery capability.
3. Provider feedback posts to the merchant’s versioned /recoverkit/v2/email-webhook/{revision} endpoint and must pass signature verification.
4. Keep shopper payloads local. The retired cloud v1 shopper endpoints reject migrated stores before reading the request body.

What to expect

Control signatures bind method, path, timestamp, nonce, installation and exact body. Update manifests are verified against a separately provisioned publisher public key. Monthly grants belong to legacy protocol compatibility, not the current Free/Pro contact workflow.

The downloadable integration reference describes the current account protocol, local WordPress interface and legacy compatibility boundaries. Legacy v1 shopper upload routes are not the normal data path for current installations.