WP Product Code Manager

The problem

A store selling digital goods delivered activation codes by hand. Someone watched the order list, found a free code in a spreadsheet, pasted it into an email, and crossed it off, which meant delivery took as long as it took a person to notice, and buyers who paid at night waited until morning. It also meant the same code could be sent twice, because nothing but a human's attention stopped it.

The other half of the problem was reach. Orders did not only come from the shop: a marketplace channel produced orders too, and it expected delivery within minutes. Whatever fulfilled an order had to be callable from outside WordPress, without handing out an admin account.

Before → After

Before	After
An operator watches the order list and pastes codes manually	Order events trigger delivery: no one has to be watching
Delivery speed limited by working hours	A code arrives immediately after payment, at any hour
Codes tracked in a spreadsheet: double-sends possible	Codes stored with state; issuing and activating are recorded events
Only reachable from inside the WordPress admin	Token-authenticated API: external systems fulfil orders directly
Marketplace orders handled as a separate manual process	Same delivery path regardless of where the order originated
No record of which code went to which order	Code, order and status linked and queryable

How it works

Codes are generated and stored. The plugin owns code creation and keeps each code with its state, so the inventory is a table with an audit trail rather than a spreadsheet cell.
Order events drive delivery. Handlers listen for order creation and order status changes. When a paid order needs a code, the handler resolves one and attaches it, which is what turns delivery from a task someone performs into a consequence of payment.
Activation is a separate step. Issuing a code and activating it are distinct operations, so a code that was handed out but never redeemed is distinguishable from one that was consumed.
An API exposes the same flow. Endpoints are authenticated by token, letting an external system , a marketplace integration, an internal tool, fulfil an order without a session or an admin account. The delivery logic has exactly one implementation, called from both sides.
External orders are addressable. The plugin can resolve the set of orders that came from an external channel, which is what makes marketplace fulfilment a query rather than a reconciliation exercise.

Key features

Code generation and storage with per-code state
Separate issue and activation operations
Order handlers for creation and status change: delivery without human intervention
Token-authenticated REST API for external fulfilment
Queries for orders arriving from an external marketplace channel
Code, order and status linked for later audit

Installation

Upload the plugin folder to /wp-content/plugins/ and activate it
Let activation create the code tables
Generate or import the initial code inventory
Issue an API token for each external system that will fulfil orders
Place a test order end to end and confirm the code is attached automatically