See my answers below:
- How clients connect to download file on my server, via mag+ first or just connect directly to file on my server?
When a user decides to download an issue the app will contact Mag+ Publish, Mag+ Publish will then send back the URL for the file to the app and the app will then download the file directly from your server.
- If user connect directly to download that file, how can I protect from another one who not subscribe that know the URL ?
You can use Secure URLs: "If you host your issues with Mag+, you now have the option to use secure URLs. That means the URL to the MIB file will expire after one hour and a new URL will be generated. This is an option that you need to request from your sales rep or by emailing firstname.lastname@example.org."