Key Concepts

Before diving deeper, here are the main concepts you’ll work with in Latch.

Publication

A publication is your workspace in Latch. Products, prices, customers, paywall rules, segments, API keys, and Stripe settings are all scoped to a publication.

Products and Prices

A product represents something you sell, such as Premium Access. A product can have multiple prices.

Product properties

Property	Description
Name	Display name
Description	Optional internal description

Price properties

Property	Description
Interval	free, month, year, or lifetime
Amount	Price in cents
Currency	ISO currency code
Trial days	Optional free trial period

If Stripe is configured, paid products and paid prices are synced there automatically.

Paywall Rules

A paywall rule defines when and how to gate content. Rules are evaluated in ascending priority order and the first matching rule wins.

Rule types

Type	Behavior
Metered	Allow a limited number of free views, then gate
Hard	Always gate unless the user has a matching subscription
Registration	Require an identified userId but not a subscription
Soft	Grant access and return a paywall hint in the response

Conditions

The current access engine evaluates these fields:

• url_pattern — operators: contains, matches, eq
• has_user — whether a userId is present
• segment_id — whether the reader belongs to a segment

Action

Field	Description
productIds	Products that satisfy the rule
message	Paywall copy
meterLimit	Free-view limit for metered rules
template	modal, bottom-bar, or inline

Note

Meter counters currently use a rolling 30-day TTL in Redis. They do not reset on a calendar month boundary.

Customers

Customers are your readers. A customer has:

• email and optional name
• optional custom attributes
• zero or more subscriptions
• optional password for self-service authentication

Customers can be created manually in the dashboard, via the admin API, or via the customer auth endpoints (/api/v1/auth/customers/register). Checkout flows currently expect an existing customerId.

Customer Authentication

Customer auth is optional. When enabled, customers can register and log in with email and password on your publisher site.

• JWT access tokens (15-minute expiry) for stateless identity verification on access checks
• Opaque refresh tokens (30-day expiry) for renewing access tokens without re-entering credentials
• Refresh tokens are rotated on each use (old tokens are invalidated)
• The SDK handles token storage (localStorage), automatic refresh, and attaching the JWT to access checks

Authentication replaces the untrusted identify() / userId query parameter with a cryptographically verified identity.

Segments

Segments group customers by shared characteristics.

Example:

subscription_status = "active"
AND
visit_count >= 3

The current evaluator supports built-in fields such as subscription_status, visit_count, email, and any custom-attribute key stored on the customer.

API Keys

Publishable keys (pk_)

• safe to expose in browser code
• can check access, send events, and call customer auth routes

Secret keys (sk_)

• must stay server-side
• can look up subscriptions and create checkout or portal sessions

Note

Both keys are created together and both full values are shown only once. After creation, the dashboard keeps only their prefixes.

Access Check Flow

When a browser integration checks access:

1. it sends the page URL plus identity fields to GET /api/v1/access/check
2. the API authenticates the request with a publishable key
3. the access engine looks up any matching entitlement for the userId
4. rules are evaluated in priority order
5. the first matching rule decides the response
6. if nothing matches, access is granted

Current grant reasons are subscribed, free_content, metered_remaining, registered, and error_fallback.