ChatGPT answers, unedited

For a small indie studio, I’d shortlist Lemon Squeezy and itch.io, with the choice depending on whether you want your own storefront or a game marketplace.

My pick: Lemon Squeezy

Lemon Squeezy is probably the best fit if you’re selling directly from your own website.

• Secure download delivery: files are delivered through securely signed, throttled download links rather than exposing a permanent public file URL. www.lemonsqueezy.comwww.lemonsqueezy.com
• Large files: you can attach up to 5 GB total per product according to their current documentation. docs.lemonsqueezy.com
• License keys: it can automatically generate unique keys, with configurable activation limits and license duration. docs.lemonsqueezy.com
• Good automation: webhooks/API let you connect purchases to your own account system, launcher, or license server. docs.lemonsqueezy.com
• Security/operations: it also handles payment-card compliance and acts as merchant of record, which substantially reduces the amount of payment/tax infrastructure you have to operate yourself. www.lemonsqueezy.comwww.lemonsqueezy.com

The main caveat: if your builds regularly exceed 5 GB per product, I'd use dedicated object storage/CDN infrastructure instead of trying to make your commerce platform double as a large-file CDN.

Best alternative: itch.io

itch.io is excellent if you're happy to sell through a game-focused storefront rather than primarily through your own site.

Its download-key system is particularly appropriate for games: purchases get unique download pages, and you can generate/revoke individual or bulk keys. It can also distribute external keys such as Steam keys. itch.io

It also has an API that lets you programmatically verify download-key ownership, which is useful if you eventually build your own launcher or entitlement system. www.lemonsqueezy.comdocs.lemonsqueezy.comwww.lemonsqueezy.comitch.ioitch.io

What I'd use for an indie studio

One important security distinction

Don't rely on merely putting a ZIP behind an obscure URL. For paid builds, I'd want:

payment → entitlement → short-lived/signed download URL → CDN/object storage

and separately:

purchase → unique license/Steam key → redemption/activation tracking

That way, leaking a download URL doesn't give someone a permanent unrestricted endpoint, and leaked license keys can be revoked or limited.

If you tell me roughly how large your builds are (e.g. 2 GB, 20 GB, 100 GB), whether you're selling on your own website, and whether you need Steam keys, I can narrow this down to the best 2–3 setups and their approximate costs.

For a small indie studio selling large game builds + keys, I’d narrow it to three choices:

My pick: lemonsqueezy.com

If you want selling + payment + tax handling + license keys + secure downloads in one service, Lemon Squeezy is probably the best fit.

• Secure, signed download URLs that expire and are rate-limited. Lemon Squeezy Docs Lemon Squeezy
• Built-in software license-key management, including issuing, deactivating, and reissuing keys. Lemon Squeezy
• Customers can return later and retrieve their purchases through their order history. Lemon Squeezy Docs
• It acts as a merchant of record, which can substantially reduce the tax/payment-compliance burden for a small studio. Lemon Squeezy
• Important limitation: their current documentation says each product can contain up to 5 GB total of files. Lemon Squeezy Docs

So if your builds are, say, 500 MB–4 GB, I'd seriously consider it.

Best if your builds are huge: sendowl.com

SendOwl is particularly attractive if file delivery itself is your main concern.

It supports large software files, secure/expiring download links, download controls, and license-key delivery. Its current platform documentation advertises unlimited storage and no artificial file-size restrictions. SendOwl SendOwl

The tradeoff is that it's more of a digital-delivery platform than an all-in-one indie-game storefront/payment solution, so you may need to assemble more of the commerce stack yourself.

Best for an indie-game-native approach: itch.io

If you're happy selling through itch.io, it's remarkably well suited to games.

Its download keys are effectively access credentials to your game's files, and you can generate individual or bulk keys, track their use, and revoke them. itch.io It also has a server-side API if you want to integrate purchases/keys with your own systems. itch.io

The downside is less control over your own checkout/customer experience compared with running your own store.

What I'd choose

One thing I wouldn't do is simply put a ZIP on Google Drive, Dropbox, your web server, etc. and email customers a permanent URL. For paid game builds, you want entitlement checking + expiring/signed URLs + rate limiting + revocation after refunds + resumable large-file downloads.

If you tell me roughly how big your builds are (e.g. 2 GB, 15 GB, 50 GB), whether you're selling Steam keys, and whether you already have a website/store, I can recommend a specific architecture and estimate the delivery cost per 1,000 downloads.

For a small indie studio selling large downloadable builds + Steam/other platform keys, I’d narrow it to two strong choices:

My pick: Lemon Squeezy

lemonsqueezy.com is probably the best fit if you want your own storefront/checkout without building the delivery infrastructure yourself.

Why:

• Secure download delivery: download links are signed and throttled, which helps prevent casual link sharing and abusive traffic. LemonSqueezy LemonSqueezy
• License keys: it automatically generates unique keys per purchase, with configurable activation limits and license duration. Lemon Squeezy Docs
• Large files: it supports up to 5 GB total files per product, with arbitrary file types such as ZIPs and software. Lemon Squeezy Docs
• Updates: you can replace the files and existing purchasers get the updated files rather than requiring you to manually email everyone. Lemon Squeezy Docs
• Payments/tax: it's a merchant of record, so it handles payment processing and sales-tax/VAT responsibilities. LemonSqueezy

The big caveat is the 5 GB-per-product limit. If your builds are 10–50+ GB, I'd use a different architecture.

Best if you're specifically an indie game studio: itch.io

itch.io is remarkably good for this use case and may actually be the easiest answer if you don't need a highly customized store.

It hosts the game files, handles purchase access, and gives each purchaser a unique download key. It also supports generating/revoking individual and bulk download keys and distributing external keys such as Steam keys. itch.io itch.io

The particularly nice part for an indie studio is that the download entitlement and the Steam key can live together: a customer can purchase your game, download the build from itch.io, and retrieve their Steam key from the same purchase page. itch.io

itch.io also lets you sell directly with Stripe/PayPal rather than requiring another storefront. itch.io

What I'd choose

For very large builds, I'd actually avoid putting the files directly into an ecommerce platform. A robust setup is:

Checkout → payment webhook → entitlement record → short-lived signed download URL → object storage/CDN

For example, you could put encrypted/private builds in Cloudflare R2 or Amazon S3 and only issue a temporary signed URL after verifying the customer's purchase. That gives you much more control over bandwidth, revocation, abuse prevention, regional delivery, and files tens or hundreds of GB in size.

One other important consideration: don't treat a Steam key as your primary security mechanism. Recent indie releases have had substantial problems with stolen/abused Steam keys and gray-market resale. GamesRadar+ Keep your downloadable build entitlement and platform key inventory separately controllable, and only expose a Steam key after a legitimate purchase is confirmed.

If you tell me roughly how large your builds are (e.g. 2 GB, 15 GB, 80 GB) and whether you're selling through your own website or itch.io, I can recommend a specific architecture and the cheapest option for your scale.

For a small indie studio, I’d strongly recommend object storage + short-lived signed download URLs, rather than a generic file-sharing service.

My top pick: Cloudflare R2

Cloudflare R2 is probably the best fit if you're comfortable having a small amount of backend code.

Why:

• Private by default: keep your builds inaccessible to the public.
• Signed download links: after a customer buys a game, your server generates a temporary URL for that specific build. R2 supports presigned URLs with expirations from 1 second up to 7 days. developers.cloudflare.com
• Large files: R2 supports objects up to 5 TiB and multipart transfers for large files, including resumable uploads. developers.cloudflare.com
• S3-compatible: you can use standard S3 SDKs rather than learning a proprietary storage API. developers.cloudflare.com
• Good security model: your actual storage credentials never go to the customer; your backend hands them a temporary bearer URL. developers.cloudflare.com

A typical setup would be:

Customer purchases game
        ↓
Your store/payment system
        ↓
Your backend verifies purchase
        ↓
Generate short-lived signed URL
        ↓
Customer downloads directly from R2

I'd make the URL expire in something like 15–60 minutes, while allowing the customer to request a fresh link from their purchase page. This limits the damage if someone posts a download URL publicly.

Runner-up: Amazon S3

Amazon S3 is the more established alternative and is excellent technically. S3 has the same fundamental signed-URL model, supports very large objects, and has mature tooling. docs.aws.amazon.com

I'd choose S3 if your studio already uses AWS. Otherwise, R2 is likely simpler for an indie operation, particularly if you're distributing many large builds.

What I would not use as the core delivery mechanism

I wouldn't make Dropbox, Google Drive, OneDrive, WeTransfer, etc. the foundation of your storefront. They're designed primarily for people sharing files, rather than purchase → entitlement → authenticated download → revocation/version management.

Likewise, simply putting your .zip behind an obscure URL isn't sufficient. A leaked URL can become a permanent public download.

One important distinction: keys vs. builds

If you're selling Steam/Epic/etc. keys, the key itself should be treated separately from the game files:

• Store the key encrypted.
• Associate it with an order/customer entitlement.
• Reveal it only after successful payment.
• Don't put the key in the downloadable ZIP.
• Keep an audit trail of when it was revealed/redeemed.

For the actual game builds, use private object storage + signed URLs.

If I were building this for a 2–10 person indie studio today, my default stack would be: your existing storefront/payment processor + a tiny backend + Cloudflare R2 + signed URLs. It gives you a professional delivery system without having to build your own file-transfer infrastructure. developers.cloudflare.com

If you tell me what you're using for the storefront/payment side (Stripe, Shopify, WooCommerce, custom site, itch.io, etc.) and roughly how large your builds are, I can recommend the specific architecture and software stack.

For a small indie studio selling large downloadable builds + activation keys, I’d avoid generic file-sharing services (Dropbox/Google Drive/WeTransfer) and use a proper object-storage + signed-download setup.

My top pick: Cloudflare R2 + your own checkout/account system

Cloudflare R2 is particularly well suited if you’re comfortable having a developer integrate it.

Why:

• Large files: R2 supports objects up to 5 TiB using multipart uploads, with resumability for large files. developers.cloudflare.com
• Secure delivery: your server can generate a short-lived, signed download URL after verifying that the customer purchased the game. The customer never gets your storage credentials. developers.cloudflare.com
• S3-compatible: you can use standard S3 SDKs/tools, so you're not locked into a proprietary API. developers.cloudflare.com
• Good architecture for games: store GameName-Windows.zip, GameName-macOS.zip, patches, DLC, etc. in private buckets and issue downloads only after authentication/payment.
• You can put a download portal on your own domain, e.g. downloads.yourstudio.com, rather than sending customers to a third-party file host.

The important distinction is that R2 is storage/delivery infrastructure, not the entire commerce system. You'd still need your storefront/payment processor and a small backend that connects "purchase → entitlement → signed download."

If you want almost zero engineering: itch.io

itch.io is probably the easiest answer for an indie studio that doesn't want to build this infrastructure.

Its purchase system creates a unique download page for each transaction, and customers can return to it to download updated files. It also supports distributing external keys such as Steam keys. itch.io

So you get:

Payment → entitlement → download page → game files + key

without having to build that machinery yourself.

The tradeoff is that your customer experience and distribution are tied to itch.io rather than completely controlled by your studio.

What I'd choose

Security architecture I'd recommend

Don't make your game ZIPs publicly accessible.

Instead:

Customer pays
→ Order marked paid
→ Customer authenticates
→ Backend verifies entitlement
→ Backend generates signed URL valid for, say, 1 hour
→ Customer downloads directly from R2

R2 specifically supports presigned URLs for this use case; they're temporary and scoped to an individual object. developers.cloudflare.com

One nuance: a signed URL is a bearer token. Anyone who obtains it can use it until it expires, so you shouldn't put permanent download URLs in emails or expose your storage bucket publicly. developers.cloudflare.com

If you tell me (1) what you're using for checkout/storefront (Stripe, Shopify, WooCommerce, custom, etc.), (2) typical build size, and (3) whether you're selling Steam keys as well as DRM-free builds, I can recommend a concrete stack and architecture for your studio.

For a small indie studio, I’d narrow it down to three good approaches, depending on whether you want a storefront or just secure file delivery.

My top pick: itch.io

If you’re comfortable selling through a game-focused storefront, itch.io is probably the easiest fit.

• Customers get a unique download key/URL after purchasing.
• You upload the Windows/macOS/Linux builds directly.
• Buyers retain access to future builds you upload.
• You can issue individual or bulk download keys for press, backers, reviewers, etc.
• It also supports distributing Steam keys alongside your downloadable build.
• You don't need to build your own download authentication system. itch.io
• itch.io explicitly recommends uploading files directly rather than relying on third-party file hosts. itch.io

For an indie game, that's a pretty compelling combination.

itch.io creator documentation

Best if you want your own store: Lemon Squeezy

Lemon Squeezy is attractive if you want customers buying through your website rather than an itch.io page.

It combines:

• Checkout/payment processing
• Digital-file delivery
• License-key generation
• Activation limits
• License API/webhooks
• Product variants

Its current limit is 5 GB total files per product, so it's great for moderately sized builds but potentially restrictive for modern 20–50+ GB games. docs.lemonsqueezy.com

Lemon Squeezy

Best for very large builds / maximum control: Cloudflare R2

If your builds are 10s or 100s of GB, I'd consider separating commerce from file delivery.

A particularly good architecture is:

Your store → your backend → Cloudflare R2 → temporary signed download URL

R2 supports S3-compatible storage and presigned URLs, so your actual bucket can remain private. Your server verifies that the customer owns the game and then generates a short-lived URL that allows the customer to download that particular file. developers.cloudflare.com

For large files, R2 also supports multipart uploads up to 5 TiB, with resumable/parallel uploads. developers.cloudflare.com

Cloudflare R2 documentation

AWS S3 is the equivalent alternative. Its presigned URLs provide time-limited access to private objects and can be used directly by a browser or download client. docs.aws.amazon.com

Amazon S3

What I'd choose

One important distinction: a signed download URL protects access to the file; it doesn't prevent a legitimate customer from copying the downloaded game. If you're trying to prevent key sharing/re-selling, that's a separate licensing problem.

For a small studio, I'd generally avoid building an S3/R2 delivery system from scratch unless your builds are too large for a storefront's limits. The engineering cost of handling refunds, expired links, customer re-downloads, abuse, support cases, bandwidth, etc. can outweigh the storage savings.

If you tell me roughly how large your builds are (e.g. 2 GB, 20 GB, 80 GB) and whether you're already selling through your own website, Steam, or another storefront, I can recommend a specific setup and estimated monthly cost.

For a small indie studio, I’d separate “selling the game” from “serving the game files.” The best choice depends on whether you want an all-in-one service or are comfortable running a small backend.

My top pick: Lemon Squeezy

Lemon Squeezy is probably the best low-maintenance option if you're selling directly from your own site.

It handles:

• Digital-file hosting and secure delivery — you upload your ZIP/build and it delivers it after purchase. www.lemonsqueezy.com
• License/key generation with configurable activation limits. docs.lemonsqueezy.com
• Signed/throttled download links, reducing straightforward link sharing and abuse. www.lemonsqueezy.com
• Checkout, payments, fraud handling and tax/Merchant-of-Record functionality. www.lemonsqueezy.com
• Multiple builds/variants, which is useful for Windows/macOS/Linux editions. docs.lemonsqueezy.com

The big advantage for an indie studio: you don't have to build your own entitlement system, payment integration, download authorization, and license-key infrastructure.

Best if you want maximum control: Cloudflare R2 + your own entitlement service

If you're technical and expect large builds and lots of downloads, I'd seriously consider:

Your store → your backend → Cloudflare R2 → temporary signed download URL

Cloudflare R2 is S3-compatible object storage and currently has no egress charges, which is particularly attractive for games where a 20–50 GB download might be downloaded thousands of times. Standard storage is currently $0.015/GB-month, with a 10 GB monthly free tier. developers.cloudflare.com

R2 supports presigned URLs that grant temporary access to a specific object; they can expire anywhere from seconds to seven days. developers.cloudflare.com

A good architecture would be:

Customer
   │
   ▼
Your website / checkout
   │
   ▼
Payment confirmed
   │
   ▼
Your entitlement database
   │
   ├── customer owns Game A?
   ├── license/key valid?
   └── download entitlement valid?
            │
            ▼
      Generate short-lived
      R2 signed URL
            │
            ▼
       Game ZIP / build

Your R2 bucket stays private. Customers never get a permanent public URL.

I'd make the download URL relatively short-lived—say 15–60 minutes—and generate a fresh one whenever the customer clicks Download. The signed URL itself is a bearer token, so keeping its lifetime short is an important security measure. developers.cloudflare.com

What I'd choose for your studio

One important distinction: secure delivery doesn't mean DRM. A signed download URL can prevent someone from simply posting a permanent /game.zip URL, but once a legitimate customer downloads the game, you can't technically prevent them from copying the ZIP. For indie games, I'd generally combine secure delivery with per-customer license keys/entitlements, rather than trying to build aggressive DRM.

If you're already selling through your own website, my recommendation would change to R2 + a tiny entitlement/download service. It's a very good fit for a small studio because the storage/download infrastructure is inexpensive, while you retain control over your customer accounts, keys, builds, and storefront.

For a small indie studio selling downloadable builds and keys, the “best” choice is usually not a pure file-sharing service. You want a delivery system that handles:

• Large files (multi-GB builds)
• Resume-able downloads (players on bad connections)
• Expiring/authenticated links
• Key/license delivery
• Fraud prevention
• CDN-backed bandwidth
• Customer support tools (re-downloads, failed downloads, order lookup)

A few good fits:

My recommendation by studio size

1–10 person indie team, direct sales:

• Use a digital commerce layer like SendOwl (or your storefront platform’s digital delivery tools).
• Store builds privately.
• Deliver via protected links.
• Generate keys automatically.
• Keep a separate patch/update strategy.

If your game is 10–50 GB and you expect launch spikes:

• Use object storage + CDN:
  • Storage: S3/R2/etc.
  • Delivery: CDN
  • Access: signed URLs tied to purchases
  • Database: order → customer → download entitlement

If you sell Steam/Epic keys plus DRM-free builds:
A common setup is:

• Storefront handles checkout
• Key generator handles platform keys
• Download service handles DRM-free files
• Customer account system tracks entitlements

Avoid using:

• Google Drive/Dropbox links for paid games
• Public S3 buckets
• Permanent download URLs
• Emailing ZIP files manually
• A single VPS serving all downloads

Those tend to fail at launch time or make piracy/leaks harder to control.

For most indie studios, I’d start with SendOwl or a similar digital delivery service, then move to S3/R2 + CDN + signed URLs once download volume justifies custom infrastructure. www.akamai.comwww.sendowl.com

If you tell me your typical build size (e.g., 2 GB vs 40 GB), monthly sales volume, and whether you sell through your own website or a marketplace, I can narrow this down.

For a small indie studio selling large downloadable game builds plus keys, I’d lean toward an e-commerce platform that handles both secure file delivery and licensing, rather than trying to build download security yourself.

Best overall: Lemon Squeezy

It’s particularly well matched to your use case:

• Secure download delivery: files are hosted for you, with securely signed and throttled download links. www.lemonsqueezy.com
• License keys: it can automatically generate unique keys per purchase, with configurable activation limits and license duration. docs.lemonsqueezy.com
• Large binary files: supports arbitrary digital files including ZIPs and software. www.lemonsqueezy.com
• Customer access: customers can access their licenses and purchased files through its customer/order experience. docs.lemonsqueezy.com
• Less infrastructure for you: it also handles checkout, payments, fraud prevention, and tax as a merchant of record. www.lemonsqueezy.com

For a small team, that's a substantial advantage: you don't have to build S3-style signed URLs, purchase verification, key issuance, download throttling, refund handling, etc.

Best if you're already centered on indie-game distribution: itch.io

itch.io is arguably the simplest solution if you're happy for the store/download experience to live there. It hosts your game files and provides purchasers with unique download keys/URLs. itch.ioitch.io

It also supports distributing external keys such as Steam keys to purchasers. itch.ioitch.io

The tradeoff is that it's more of a game storefront/distribution platform than a backend you control for your own store.

Worth considering: Gumroad

Gumroad supports software license keys and has an API for verifying them, including activation/use limits that you can enforce in your game. gumroad.com

I'd put it behind Lemon Squeezy for a game studio, though, because Lemon Squeezy's combination of file delivery + software licensing + signed downloads is closer to your exact requirements.

What I'd choose

One important distinction: download security and DRM are different things. A signed download URL can prevent someone from simply posting your private ZIP URL publicly, but once a customer downloads an unencrypted game build, you can't make the binary itself impossible to copy. Your license system is what should control whether the game is authorized to run.

For your situation, I'd probably build the architecture as:

Website → Lemon Squeezy checkout → signed build download + unique license key → game activates key against your licensing API

That gives you considerably more control than just emailing customers a permanent Google Drive/S3 link.

If your builds are 10–100+ GB, that's where I'd evaluate the options differently, because bandwidth/storage economics and resumable downloads become important.

For a small indie studio selling downloadable builds + activation keys, I’d prioritize a service that handles secure file delivery, expiring/controlled downloads, payments, refunds, and key fulfillment rather than trying to build the delivery layer yourself.

My shortlist

itch.io is particularly compelling for your use case: purchases automatically produce a unique download URL, customers can re-download updated builds, and you can distribute external keys such as Steam keys alongside the downloadable game. itch.io

itch.io developer documentation

Lemon Squeezy is the one I'd investigate if you want customers buying from your own branded storefront rather than primarily through a game marketplace. It hosts and securely delivers files after purchase and supports arbitrary file types, but its current limit is 5 GB total files per product, which can become restrictive for modern 3D games. docs.lemonsqueezy.com

Lemon Squeezy

Gumroad allows a substantially larger 20 GB individual file for paid products, so it's viable for big builds. But I'd regard it more as a general digital-product platform than a purpose-built game distribution system. gumroad.com

Gumroad

What I'd choose

If you're small and don't want to maintain infrastructure:

itch.io → downloadable build + Steam keys

If you're selling primarily from your own website:

Lemon Squeezy → checkout/license management + hosted downloads

If your builds are 10–50+ GB, I'd skip the ecommerce platforms' file hosting and use a dedicated object-storage/CDN setup (e.g. S3-compatible storage + CDN) with signed, time-limited download URLs. That gives you much better control over bandwidth, resumable downloads, versioning, and access revocation.

One important distinction: "secure delivery" doesn't mean preventing customers from copying the game once they've downloaded it. The realistic goal is preventing unauthorized access to the download, protecting paid keys, limiting abuse/bandwidth theft, and making legitimate re-downloads painless.

If you tell me roughly how large your builds are (e.g. 2 GB, 15 GB, 50 GB) and whether you already have Stripe/Shopify/a website, I can narrow this down to the best 2–3 architectures for your studio.

For a small indie studio selling downloadable game builds + license/Steam keys, my top pick would be Lemon Squeezy if you want the least infrastructure to maintain.

My ranking

Why I'd choose Lemon Squeezy: it combines checkout, file hosting, secure delivery, and licensing. Its download URLs are signed, expire after an hour, and are rate-limited; it also supports automatically generated license keys with configurable activation limits. docs.lemonsqueezy.com

That means your architecture can be roughly:

Customer → Lemon Squeezy checkout → payment → signed download → game ZIP + license key

rather than building your own authenticated download system.

Lemon Squeezy digital products

When I'd pick itch.io instead

If your studio is primarily selling games rather than software, I'd seriously consider itch.io. Its download keys are unique URLs granting access to your uploaded game files, and it has APIs for validating those keys. itch.io

It's particularly attractive if you want your customers to have an itch.io game-library experience rather than building that yourself.

What about Gumroad?

Gumroad is viable, particularly for smaller builds. Paid products can have individual files up to 20 GB, and Gumroad supports license-key generation and verification for software. docs.lemonsqueezy.comitch.iogumroad.com

I'd put it behind Lemon Squeezy for your use case because secure delivery + software licensing are more central to what you're describing.

If you want maximum control

For a studio with its own website/store, I'd consider:

Cloudflare R2 or Amazon S3 + CDN + your own checkout/licensing backend

Store the builds privately, then issue short-lived signed URLs after verifying the purchase. This can be extremely robust and inexpensive at scale, but you're responsible for authentication, key management, refunds/revocations, abuse prevention, download entitlements, etc.

Bottom line:

• Small studio, want to ship now: Lemon Squeezy
• Game-first / indie community: itch.io
• Simple digital-product storefront: Gumroad
• Already have a custom store / engineering resources: R2/S3 + signed URLs

If you tell me roughly how large your builds are (e.g. 2 GB, 20 GB, 100 GB), expected monthly downloads, and whether the "keys" are Steam keys or your own license keys, I can recommend the cheapest/most secure architecture for your specific scale.

For a small indie studio, I’d separate selling/entitlement from file delivery. You want customers to get a reliable download, while making the underlying build files private and difficult to casually share.

My default recommendation: Cloudflare R2 + signed download URLs

Cloudflare R2 is probably the best fit if you have your own storefront or website.

• Store builds as private objects in R2.
• After a successful purchase/key redemption, your backend generates a short-lived presigned URL for that customer's build.
• The URL can be restricted to a particular file and expires automatically; R2 supports presigned URLs from 1 second up to 7 days. developers.cloudflare.com
• R2 currently has no Internet egress charges, which is particularly attractive for games where a 20–100+ GB build might be downloaded many times. Standard storage is $0.015/GB-month, with 10 GB-month free. developers.cloudflare.com
• It's S3-compatible, so you're not locked into a proprietary file-delivery API. developers.cloudflare.com

Cloudflare R2 documentation

Architecture I'd use:

Storefront → payment/key redemption → your backend → entitlement check → short-lived R2 URL → game download

That gives you considerably more control than emailing customers a permanent download link.

If you don't want to build much infrastructure

itch.io is the easiest option if you're comfortable selling through a platform rather than your own checkout. Its download-key system associates purchasers with access to the files, and buyers can continue accessing files you've uploaded to the project. itch.io

Itch also recommends uploading the game files directly rather than using third-party download services. itch.io

itch.io creator documentation

Amazon S3 is the other strong choice

Amazon Web Services S3 is extremely mature and supports the same basic pattern: private objects + presigned URLs. AWS explicitly supports downloads of objects up to 5 TB and presigned URLs for temporary access. docs.aws.amazon.com

I'd choose S3 over R2 if you're already heavily invested in AWS. For a small studio starting from scratch, R2's lack of egress fees makes it particularly compelling for game distribution.

What I would not do

Avoid putting your actual build behind:

• permanent public URLs
• Google Drive/Dropbox-style shared links
• a public S3/R2 bucket
• links containing the customer's permanent entitlement token
• your web server's filesystem

Also, don't mistake a signed URL for DRM. A customer can still copy the downloaded game. The security benefit is that the download endpoint itself isn't permanently reusable.

If you're selling Steam keys + direct downloadable builds + console/DRM-free builds, the ideal architecture gets a little more interesting because you can have one entitlement system issue the appropriate file/key for each purchase. I can lay out a concrete $0–$50/month stack for a small indie studio, including storefront, payments, key management, R2, authentication, and the download flow.

For a small indie studio selling game builds + license/Steam keys, I’d separate “secure file delivery” from “DRM.” You can make downloads difficult to abuse, but no delivery service can prevent a customer from copying a game after they legitimately download it.

My top pick: SendOwl

SendOwl is probably the best fit if you want to sell directly from your own website without building the delivery infrastructure yourself.

Why I’d choose it:

• Large-file delivery for software/game builds. www.sendowl.comwww.sendowl.com
• Time-limited download links and configurable download limits, which substantially reduces casual link sharing. www.sendowl.com
• License-key generation/delivery, useful if you're selling your own keys in addition to builds. www.sendowl.comwww.sendowl.com
• Can host the files itself or use Amazon S3, giving you an option to control your storage architecture. www.sendowl.comwww.sendowl.comhelp.sendowl.comdocs.lemonsqueezy.comdocs.lemonsqueezy.comitch.io
• Automatic fulfillment means your flow can simply be payment → key + secure download → customer gets the build. help.sendowl.com
• It supports software/games specifically, rather than being merely a generic file-sharing service. apps.shopify.com

One caveat: SendOwl normally limits the number of downloads rather than offering unlimited access; its default is three, configurable to 5 or 10. help.sendowl.com For games, I'd generally prefer something like 10 downloads + a reasonably long expiration rather than making customers fight a one-download link.

If you want a more turnkey storefront: Lemon Squeezy

Lemon Squeezy is attractive if you also want the checkout, payments, taxes, and digital delivery handled together.

Its download URLs are signed, expire after one hour, and are rate-limited to 10 downloads/day/IP. docs.lemonsqueezy.com It supports arbitrary file types and currently allows up to 5 GB total files per product. docs.lemonsqueezy.com

I'd pick this over SendOwl if tax/payment administration is as important to you as file delivery.

If your games are primarily PC builds: itch.io

itch.io is worth considering if you don't necessarily need your own checkout.

It has a particularly nice game-oriented model: purchasers receive download keys/URLs granting access to the game's files, and it has an API for verifying purchases and download keys. itch.io

It's much more game-native than generic digital-download services, but you're giving up some control over the direct-sales experience.

What I'd build for an indie studio

If you're selling from your own website, I'd use:

Your website → payment processor/store → SendOwl → secure build download

and separately:

Purchase → unique license/Steam key → customer

For the actual build, I'd use ZIP/installer archives rather than exposing a permanent S3/public URL. The important security properties are:

1. No permanent public download URL.
2. Signed/time-limited download URLs.
3. Per-customer download limits.
4. Ability to revoke/reset a customer's download access.
5. Keys associated with the order/customer.
6. Refund automatically invalidates the key/access where possible.
7. Keep the actual storage bucket private.
8. Put your game version/build number in the order metadata so support can tell exactly what the customer received.

Bottom line: For your specific description, SendOwl is my first choice, Lemon Squeezy if you want a more all-in-one commerce/tax solution, and itch.io if you want a game-centric distribution platform rather than primarily running your own storefront.

For a small indie studio, I’d separate “where the files live” from “how customers prove they bought them.” You generally don’t want to email builds or put paid builds behind a permanent public URL.

My top pick: Cloudflare R2 + your store/payment system

Cloudflare R2 is probably the best fit if you have—or are willing to build—a small customer download service.

• Cheap for large downloads: R2 is specifically designed for large amounts of internet-served data and has no egress bandwidth fees, which is particularly attractive for games where customers may repeatedly download multi-GB builds. developers.cloudflare.com
• Keep everything private: Don't make the bucket public. After verifying a customer's purchase, your server generates a short-lived presigned download URL. R2 supports expiring URLs from 1 second to 7 days. developers.cloudflare.com
• Good security model: Your R2 credentials never go to customers; the temporary URL only grants access to the specific file. Cloudflare explicitly recommends presigned URLs for anonymous/customer access. developers.cloudflare.com
• Encryption: R2 encrypts objects at rest with AES-256 and uses TLS for transfers. developers.cloudflare.comdevelopers.cloudflare.comdevelopers.cloudflare.com

A typical setup would be:

Purchase → payment/store webhook → create entitlement → customer opens download page → authenticate purchase → generate 1-hour signed URL → R2 delivers the build

That gives you considerably more control than sending a static download link around.

If you don't want to build infrastructure: itch.io

itch.io is probably the easiest answer for a tiny studio.

Its download keys/URLs are already designed around paid game ownership, and itch.io handles access to your uploaded files. It also exposes APIs for checking whether a download key is valid. itch.io

I'd choose itch.io if your priority is:

“We want customers to buy the game and download it securely without us building a distribution backend.”

I'd choose R2 if your priority is:

“We sell through our own website and want complete control over distribution.”

AWS S3 is the other strong option

Amazon S3 provides essentially the same fundamental architecture: private objects + temporary presigned URLs. AWS allows presigned downloads to be valid for a limited period, and the URL can be used directly in a browser. docs.aws.amazon.com

It's extremely mature, but for an indie studio I generally prefer R2 for download-heavy games because bandwidth/egress economics are simpler.

What I'd avoid

Dropbox/Google Drive/OneDrive: fine for sending a build to a reviewer, not ideal as your customer distribution system.

Permanent public CDN URLs: convenient, but anyone who obtains the URL can potentially redistribute it.

Password-protected ZIPs: adds friction without solving entitlement/revocation very well.

Building your own file server: unnecessary operational/security burden when object storage already solves the hard parts.

One important distinction

If by “keys” you mean Steam/GOG/etc. activation keys, that's a different problem from delivering your actual game files. You'd want a system that tracks:

• customer/order ID
• entitlement to each product/version
• activation key
• key redemption status
• download authorization
• revoked/refunded orders
• build/version
• download/audit events

For a small studio, my practical ranking would be:

If you tell me what you're using for the storefront/payment side (Shopify, Stripe, WooCommerce, custom site, itch.io, etc.) and roughly how large the builds are (e.g. 2 GB vs 50 GB), I can recommend a specific architecture and the cheapest/safest option for your situation.