Gumroad
Gumroad can generate a license key per sale and put it in the buyer's receipt. With this integration that key is the buyer's SunLicense key: your app validates it with SunLicense, so you get machine limits, revocation and offline files on top of Gumroad's checkout.
Setup
- On each product: Content → License key → Generate a unique license key per sale.
- Integrations → Gumroad → Connect in SunLicense. Map products by product ID or permalink (the
abcdeingumroad.com/l/abcde), or*. Paste your seller ID (Gumroad Settings → Advanced): pings for any other seller are then refused. - Gumroad Settings → Advanced → Ping endpoint: paste the hook URL and save.
Make a test purchase of your own product: the event log shows sale · issued and the license carries the key from the receipt.
Without Gumroad license keys, turn off Use Gumroad's license key: SunLicense then issues its own key and buyers look it up on the redeem page with their sale ID and email.
Behaviour
| Gumroad sends | SunLicense does |
|---|---|
| A sale | Creates the license (Gumroad's key, or a new one) |
A membership renewal (is_recurring_charge) | Nothing new: the membership keeps its license |
refunded=true or resource_name=refund | Revokes |
disputed=true or resource_name=dispute | Suspends; dispute_won reinstates |
subscription_ended / subscription_restarted | Suspends / reinstates |
cancellation | Nothing yet: access continues until subscription_ended |
Refund, dispute and subscription events beyond the basic ping come from Gumroad's resource subscriptions (POST /v2/resource_subscriptions with post_url = the hook URL); the ping alone covers sales.
Gumroad pings aren't signed
The unguessable URL is what authenticates them, plus the seller ID check. Treat the URL as a secret, and use New URL on the integration page if it leaks.