Updates

Loveshack is distributed privately. Authorized sites receive one-click updates through the standard WordPress theme update process, served from:

https://loveshack.dev/wp-json/update-api/v1/themes/loveshack

Set up update credentials

1. Open the Software Updates section of your Loveshack subscriber settings.
2. Create a per-installation update credential. You will be given a username and an Application Password.
3. In the WordPress admin of the site being updated, go to Loveshack → Theme Updates, enter both values, and click Connect.

Loveshack tests the credentials against the update server before saving them. Nothing is stored if the connection or authentication fails; on success the screen shows a green checkmark with the connected username.

Each installation should have its own credential, so a single site can be revoked without disturbing the others.

Loveshack → Dashboard shows the installed version at the top of the page, together with whether a newer release is available once updates are connected — or a Set up updates link while they are not.

Updating from the Dashboard

Update now in a version box on Loveshack > Dashboard updates the theme or the companion plugin in the background, the same way the Themes and Plugins screens do. The Dashboard stays open: the box shows the progress, then the installed version or the reason the update failed, with Try again.

When WordPress needs FTP or SSH credentials to write the files, Update now opens the regular WordPress update screen instead, which asks for them.

Release notes

Every update check also carries the live release's Markdown teaser and text, so two places show what a release changes:

• Loveshack → Dashboard renders a What's new panel under the version box: the teaser, the full text in a collapsible section, and a link to the release page. While a newer version is available the panel describes that version; once it is installed the same panel describes the running version.
• Appearance → Themes links View version details on the update notice. The update server points that link at the release page, which drops the site chrome when opened inside the WordPress modal.

The notes live in the same update_themes transient WordPress keeps for the update check, so nothing extra is stored.

The Dismiss link in the panel's header hides it for the current user. The dismissal is remembered per user and per release, so the panel returns as soon as the update server delivers notes for a different version.

Updates outside your tier

When a new release exists but the credential's subscription tier does not include the product, the update server still reports the version, without a package. Loveshack → Dashboard then shows the version box with a yellow warning: the available version, the tier or tiers that include it, and an Upgrade subscription button that opens the subscription page on the update server. WordPress lists the release under Appearance → Themes or Plugins as well, but marks it as not installable until the subscription includes it. The release notes of that version are shown under the box all the same, for the theme and for companion plugins alike, so you can see what the release changes before deciding on an upgrade.

Release lines and update channels

Loveshack ships in release lines: 1.4, 1.5, and so on. Each line gets its own patch releases (1.4.1, 1.4.2), and older lines keep receiving security fixes after a newer line ships.

Which lines a site receives depends on the subscription behind its update credential:

• With an active subscription, the site gets the newest release.
• After the subscription ends, the site keeps every release of the newest line it had while subscribed, including later security fixes, but not newer lines. Someone subscribed when 1.4.0 was published keeps every 1.4.x release. Loveshack → Dashboard says which line the subscription covers, names the newer version that needs an active subscription, and offers a Renew subscription button.

Under Loveshack → Theme Updates, Update channel chooses whether the site also receives pre-releases, for Loveshack and its companion plugins:

Channel	Receives
Stable	Stable releases only. The default, recommended for live sites.
Beta	Also betas and release candidates of the next version.
Alpha	Also alphas: early builds that can change or break.

Pre-releases need an active subscription. A site on the beta or alpha channel gets a stable release as soon as it is newer than the newest pre-release. The Dashboard marks pre-release versions with an Alpha, Beta, or RC badge, next to an available update, the installed version, and the release notes. Define LOVESHACK_UPDATE_API_CHANNEL as 'stable', 'beta', or 'alpha' in wp-config.php to fix the channel for a site.

Companion plugins

Loveshack plugins such as Loveshack Typefully update through the same server and the same credentials as the theme. Each plugin checks its own endpoint, for example:

https://loveshack.dev/wp-json/update-api/v1/plugins/loveshack-typefully

The plugin declares that endpoint in its Update URI header and asks the theme for the credentials, so nothing extra is configured. A plugin build from before it had an updater, such as Loveshack Typefully 0.2.0, carries no Update URI; the theme checks the update server for those builds itself, so the first update is offered the same way. Its update shows up under Plugins like any other plugin update, and Loveshack → Dashboard shows a version box for every installed companion plugin directly below the theme's. The credential's subscription tier has to include the plugin on the update server for the check to succeed.

Changing or removing credentials

The Theme Updates screen offers two actions once a site is connected:

• Change update credentials reopens the form. The new credentials go through the same connection test and replace the stored ones only when they work.
• Disable theme updates / Remove credentials deletes the stored username and Application Password after a confirmation dialog. The site then stops asking loveshack.dev for updates, so new releases — including security updates — are no longer offered or downloaded until credentials are entered again.

Supplying credentials outside the database

For deployments that manage secrets outside WordPress — Bedrock, CI-driven deploys, anything with a secrets provider — define the credentials as constants in wp-config.php instead:

define( 'LOVESHACK_UPDATE_API_USERNAME', 'your-subscriber-username' );
define( 'LOVESHACK_UPDATE_API_APPLICATION_PASSWORD', 'your-application-password' );

Constants take precedence over credentials saved through Loveshack → Theme Updates. While either constant is defined, the screen only reports the connection status and does not allow changing or removing the credentials.

Credentials can also be supplied at runtime by an MU plugin or secrets provider through filters:

Filter	Supplies
loveshack_update_api_username	The update API username
loveshack_update_api_application_password	The Application Password

The legacy shared API key remains available through LOVESHACK_UPDATE_API_KEY.

Never commit credentials

Do not add update credentials to the theme source or commit them to version control. Use constants, an MU plugin, or your secrets provider.

How an update is verified

WordPress checks the update endpoint through its normal theme update cycle. Before installing, Loveshack requests a fresh signed package URL and verifies the downloaded archive against the SHA-256 checksum the server provides. A package that does not match its checksum is rejected.

Related

• Constants reference
• Troubleshooting