I am developing my first managed package where the default installation will be free and will provide access to some data. And if a user wants to go Paid, he will have access to additional data. Currently the user details (id, password, client id, client secret, cryptokey) all are in some Custom Metadata Settings marked "Protected". The CMS fields are "Upgradeable".
But if the components are to be marked thus, I have to upgrade the package to make the user upgrade to some superuser. And then anyone who installs the package will get the superuser access.
Obviously this is wrong. So should I make the CSM "Un-Protected" and when a user pays for the superuser, should I simply provide the superuser details and ask him to upgrade the CSM in his org?
I am deep diving into the ISVForce developer guide but so far not able to get a brief theory of how it should work. Any pointer will be much appreciated.