You bought a premium theme on ThemeForest, launched your site, everything works. Six months pass, and a notification appears in the admin panel: the theme is outdated, along with a couple of critical vulnerabilities. Manual updating through downloading a ZIP from ThemeForest, uploading and replacing files is a scenario that's genuinely frustrating. Especially when you have more than one theme.

Previously, Envato WordPress Toolkit existed for this purpose, a small plugin that pulled your purchases from ThemeForest and updated themes in a couple of clicks. But Envato officially replaced it with the Envato Market plugin, which is more modern and uses OAuth token authentication instead of outdated API keys. The old Toolkit moved to the GitHub archive and is no longer supported.

This guide provides step-by-step setup of Envato Market from scratch: from obtaining a personal token to automatic theme updates, including nuances for those transitioning from the old Toolkit.

💡 Quick overview:

• Generate a personal Envato token in your ThemeForest account settings
• Download and install the Envato Market plugin from the official GitHub repository
• Enter the token and username, and the plugin automatically pulls all purchased themes
• Update themes in one click directly from the WordPress admin panel

What happened to the old Envato Toolkit

If you're still using Envato WordPress Toolkit, it's time to switch. The plugin has been removed from official support: its GitHub repository moved to envato-archive, and the API key mechanism it relied on has been deemed insecure. Envato has completely transitioned to personal tokens via OAuth, which are tied to a specific set of permissions, can be revoked at any time, and don't "leak" through server logs the way old keys did.

The new plugin, Envato Market, lives in an active repository and receives periodic updates. It looks similar: the same admin panel integration, the same purchase list. But under the hood, there's modern authentication and a more reliable update checking mechanism.

Generating a personal Envato token

A personal token is the new Envato API authentication standard that replaced the old 32-character keys. You need to create it before installing the plugin: the Envato system doesn't process new tokens instantly, and the plugin may not recognize it in the first few minutes.

Go to build.envato.com, log in with your ThemeForest account, and click Create a token. Give the token a meaningful name, for example, "Auto-update themes on client site," and set the permissions:

• View and search Envato sites, required
• View your Envato account username, required
• View your purchases, required
• Verify purchases, optional but useful for themes with licensing systems
• Leave the remaining permissions disabled

After creation, copy the token. Unlike the old API key, the token is shown only once. If you close the tab, you lose access to it. Save it in a password manager.

Downloading and installing the Envato Market plugin

Unlike regular plugins, Envato Market is not listed in the wordpress.org catalog. It's distributed only through GitHub. Go to envato.github.io/wp-envato-market and download the ZIP from the docs/ folder.

Important: don't click "Download ZIP" on the main GitHub repository page. The archive will be named wp-envato-market-master, and WordPress won't recognize it as a plugin. Get the ZIP specifically from the docs/ folder, which is packaged correctly.

Then proceed with standard installation:

• In the WordPress admin panel, go to Plugins → Add New.
• Click Upload Plugin and select the downloaded ZIP.
• Click Install Now, then Activate.

After activation, the Envato Market item will appear in the admin sidebar menu.

Configuration: linking the token to your purchases

Open Envato Market in the admin panel. You'll see two fields: Envato username and personal token. Paste the token you copied in the previous step, enter your ThemeForest login, and click Save Changes.

The plugin will query the Envato API and display a list of all themes and plugins purchased with this account. If the list is empty, wait 10-15 minutes and refresh the page. Envato needs time to "burn in" a fresh token through its infrastructure. If that doesn't help, verify that the token has the "View your purchases" permission enabled and that you're logged in with the exact account you used to purchase the themes.

A note for owners of multiple sites: you can create a separate token for each domain or one global token. A global one is more convenient: paste it on all sites, and each theme sees its license. But if you're handing the site over to a client, it's better to revoke the global token and issue a narrow one for the specific domain.

Automatic theme updates

After linking the token, the Themes tab will display a list of purchased themes with their current versions. If an update is available for a theme, an Update Available button will appear next to it.

Click it, and WordPress will run the standard update mechanism: download the fresh ZIP from Envato servers, extract it, and replace the theme files.

Before updating, there's an important point regarding customization. If you edited theme files directly (styles, templates, functions.php), the update will overwrite them, and all changes will be lost. This doesn't apply to settings made through the WordPress customizer or the theme options panel: they're stored in the database and will be preserved.

The correct approach is a child theme. Move all code modifications to it and never touch the parent theme. Then the "Update Available" button becomes safe, and you can click it without fear of losing customization.

The plugin also adds automatic update checking: WordPress will periodically query the Envato API and display notifications about new versions directly in the standard updates section.

⁉️🤔 Frequently asked questions

How does a personal token differ from the old API key?

A personal token works through OAuth. You set specific permissions, can revoke the token at any time, and it doesn't appear in URL requests. The old API key was a single perpetual string without granular rights. Envato has discontinued generation of new keys, and all new integrations work only through tokens.

Can I continue using the old Envato Toolkit?

Technically, yes, if you already have it installed and working. But the plugin hasn't been updated since 2021, its repository is archived, and Envato's infrastructure is gradually dropping support for old API keys. Sooner or later, Toolkit will stop pulling purchases. It's better to switch now while it's still alive than to scramble when a theme stops updating.

The Envato Market plugin doesn't see my purchases. What should I do?

The most common reason is that the token was created under a different Envato account (many people have multiple accounts for different marketplaces). Verify that you're logged into the exact account you used to purchase the themes. The second reason is that a fresh token hasn't been processed yet: wait 15-30 minutes. The third is that the token doesn't have the "View your purchases" permission enabled.

Do I need to install Envato Market on each site separately?

Yes, the plugin works on a per-site basis, and each site needs its own activation. You can use the same token on all sites (it's tied to the account, not the domain), but the plugin is installed and configured on each site independently.

What happens to theme customization after auto-updating?

Parent theme files are completely overwritten. Settings from the customizer and theme options panel are preserved because they're in the database. Code modifications made directly in theme files will be lost. Use a child theme for any code modifications. This is a best practice, not just a recommendation.

Should you switch from Envato Toolkit right now

If you're still using the old Toolkit, switch today. The process takes 10 minutes: deactivate Toolkit, install Envato Market, paste the token. Creating a token takes a minute, installing the plugin takes another couple of minutes, and everything works.

The main benefit isn't that "the old one still works." The benefit is that the new plugin uses infrastructure that Envato is developing and supporting. The old Toolkit is a dead end, and the question isn't "will it break" but "when." This usually happens at the worst possible moment, when a theme update is released that fixes a vulnerability, and you can't update.

Take 10 minutes, install Envato Market, and forget about manual theme updates forever.