Manage app subscriptions and entitlements
App entitlements control which features and usage limits an installed app may use. Workspace combines Commerce subscriptions, verified Google Play purchases, and access codes as independent sources. The resulting entitlement remains traceable without copying prices or payment state into the app platform.
Prerequisites
- The app registration is active.
- Activate the global
app_entitlement_catalogsystem artifact before using the supplied plan templates. - Grant administrators only the permissions required for plans, bindings, sources, seats, access codes, or service bindings.
- Configure Commerce products and subscriptions first when Commerce is the billing authority.
Create and publish a plan
Open App Platform > Entitlements > Plans. Create a draft directly or explicitly import a global template. An import creates a tenant-owned snapshot. A later template version never changes imported plans automatically; review its preview first.
Define a stable plan key, enabled features, numeric limits, and an optional seat capacity. Publishing makes the revision immutable. Create a new revision for a change and move existing sources only through preview and explicit apply.
Bind billing or a store product
For an external store, first open App Platform > Entitlements > Store connections. Select the app registration, provider, environment, and provider app identifier. Store credentials only through a reference to a tenant-owned secret. Never put credential values in the configuration, notes, or support tickets.
Then open App Platform > Entitlements > Product bindings and select the authority:
| Binding | Use | Authoritative state |
|---|---|---|
| Commerce subscription | Direct or company Workspace subscription | Commerce subscription and payment state |
| External store | For example Google Play | Server-verified store state |
The binding points to a published plan revision. It does not create another price or payment record. A pending or unverified store purchase grants no entitlement.
Use App Platform > Entitlements > Store observations to inspect the normalized verification state and validity of received store events. These records are read-only. Raw evidence, purchase tokens, and provider responses are not shown. Do not change or delete a store connection while product bindings or observation history still refer to it.
Issue access codes and assign seats
Use Access code campaigns for one-time or reusable codes. Configure the redemption limit and validity. Workspace returns a newly issued plaintext code only once, so keep it out of logs and support tickets. These codes grant an entitlement source; they are not Commerce coupons.
A company subscription does not grant every employee access. Assign an available seat to a verified identity or app actor. Revoking a seat removes the assignment but does not cancel or mutate the subscription source.
Verify the result
Compare Entitlement sources with Effective entitlements:
- Each source retains its own status and validity.
- Only active and grace-period sources contribute.
- Features are combined, and the highest value wins for each numeric limit.
- The sequence advances when the effective result changes.
If an entitlement is missing, check the binding, source state, plan revision, and company seat. Never edit provider evidence or effective projections directly.
Connect an external sync or domain service through a service binding. The integration choices are described in Connect sync and domain services to app entitlements.