DEV Community: Pau Drudis

Get Gumroad sale alerts in Discord, Slack or Telegram (and why you can't just paste the webhook URL)

Pau Drudis — Tue, 20 Oct 2026 04:07:43 +0000

You'd think getting a Discord message for every Gumroad sale would mean pasting a Discord webhook URL into Gumroad's Ping setting. Try it and nothing shows up.

Why it fails

Format. Gumroad sends application/x-www-form-urlencoded. Discord expects JSON {"content": "..."}, Slack expects {"text": "..."}, and Telegram expects {"chat_id", "text"} sent to a bot endpoint.
Trust. The ping isn't signed. Once your relay URL leaks, anyone can post fake "sales" to it.
Repeats. Gumroad can send the same ping more than once.

A 40-line relay

const http = require('http');
http.createServer((req, res) => {
  let body = ''; req.on('data', c => body += c);
  req.on('end', async () => {
    const u = new URL(req.url, 'http://x');
    if (u.searchParams.get('secret') !== process.env.PING_SECRET) { res.statusCode = 403; return res.end(); }
    const saleId = new URLSearchParams(body).get('sale_id');
    // Don't trust the ping body: fetch the real sale
    const r = await fetch(`https://api.gumroad.com/v2/sales/${encodeURIComponent(saleId)}`,
      { headers: { Authorization: `Bearer ${process.env.GUMROAD_ACCESS_TOKEN}` } });
    const { sale } = await r.json();
    const kind = sale.refunded ? 'REFUND' : 'SALE';
    await fetch(process.env.DISCORD_WEBHOOK_URL, {
      method: 'POST', headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ content: `${kind}: ${sale.product_name} $${(sale.price / 100).toFixed(2)}` })
    });
    res.end('ok');
  });
}).listen(8788);

Deploy it anywhere that runs Node, then set Gumroad's Ping URL to https://your-host/?secret=....

Making it production-grade

Dedupe on sale_id + event, so resent pings don't alert twice.
Separate events: refunds, chargebacks, disputes, cancellations.
Net after fees: Gumroad keeps 10% + $0.50 on direct sales and 30% on Discover sales. Seeing the net number changes how you price.
Referrer: sale.referrer tells you which post or site sold the product. That's the cheapest marketing analytics you'll get.
Mask emails before posting them into a shared channel.
Ledger: append every event to a CSV, and guard cells that start with =, +, - or @ so a malicious product name can't run a formula in Excel.

Want the finished version?

Gumroad Ping Relay does all of the above for Discord, Slack and Telegram at once, plus the CSV ledger. It has 13 tests and zero dependencies. To turn that ledger into a monthly P&L, see the Seller Finance Tracker.

For license keys that ignore refunds, there's a free fix: gumroad-license-check.

Selling a paid Discord community on Gumroad? Your refunded buyers probably still have access

Pau Drudis — Tue, 20 Oct 2026 04:07:05 +0000

A paid Discord is one of the easiest things to sell on Gumroad: a course community, a trading channel, a mod-support server. The usual setup goes like this: buyer pays, buyer pastes their license key into a bot, and the bot gives them a role.

There are two quiet bugs in almost every version of that setup.

Bug 1: `success: true` doesn't mean "paid"

Gumroad's POST /v2/licenses/verify returns success: true for a key even after the purchase was refunded or charged back. You have to check the purchase flags yourself:

function isActive(p) {
  if (p.refunded || p.chargebacked || p.disputed) return false;
  if (p.subscription_ended_at || p.subscription_cancelled_at || p.subscription_failed_at) return false;
  return true;
}

If your bot only checks success, a buyer can pay, get the role, refund, and stay in your server indefinitely.

Bug 2: Gumroad pings aren't signed

To remove roles on refund, you'll use Gumroad's Ping (Settings → Advanced). But the ping is a plain form POST with no signature. Anyone who learns the URL can send sale_id=... and pretend.

The fix is simple: treat the ping only as a "something changed" signal. Pull the sale ID out of it and re-fetch the real record:

const r = await fetch(`https://api.gumroad.com/v2/sales/${saleId}`, {
  headers: { Authorization: `Bearer ${process.env.GUMROAD_ACCESS_TOKEN}` }
});
const { sale } = await r.json();
if (isActive(sale)) grantRole(); else revokeRole();

Also put a long random secret in the ping URL, and compare it with crypto.timingSafeEqual.

Adding and removing the role

With a bot that has Manage Roles, and whose own role sits above the roles it grants:

const url = `https://discord.com/api/v10/guilds/${GUILD}/members/${userId}/roles/${roleId}`;
await fetch(url, { method: 'PUT', headers: { Authorization: `Bot ${BOT_TOKEN}` } });   // grant
await fetch(url, { method: 'DELETE', headers: { Authorization: `Bot ${BOT_TOKEN}` } }); // revoke

Two more things people miss

Key sharing. Store sale_id → discord_id and refuse to link the same sale to a second account.
Missed pings. Hosts restart, and pings get dropped. Run a nightly job that re-checks every linked sale and revokes anything inactive.

Free check, or the full thing

The refund-aware license check on its own is free and MIT licensed: gumroad-license-check.

If you'd rather not wire up the rest yourself, the Gumroad → Discord Access Kit packages all of it: the ping endpoint, the linking form, one-key-per-account, the nightly reconcile and 12 tests, with zero dependencies.

Your Gumroad license check probably lets refunded buyers in (and how to fix it)

Pau Drudis — Tue, 20 Oct 2026 03:35:45 +0000

If you sell software on Gumroad and gate it with license keys, there's a good chance your check looks like this:

const res = await fetch("https://api.gumroad.com/v2/licenses/verify", {
  method: "POST",
  body: new URLSearchParams({ product_id, license_key }),
}).then((r) => r.json());

if (res.success) unlock(); // looks fine...

The problem: success only tells you the key exists. After a buyer is refunded, files a chargeback, or cancels a subscription, /v2/licenses/verify still returns success: true. The status lives in the purchase object, so a check on success alone lets refunded buyers keep using your app.

The fix

Check the purchase flags too:

function evaluate(res) {
  if (!res?.success) return { valid: false, reason: res?.message ?? "invalid license" };
  const p = res.purchase ?? {};
  if (p.refunded) return { valid: false, reason: "purchase refunded" };
  if (p.chargebacked) return { valid: false, reason: "purchase chargebacked" };
  if (p.disputed && !p.dispute_won) return { valid: false, reason: "purchase disputed" };
  if (p.subscription_ended_at) return { valid: false, reason: "subscription ended" };
  if (p.subscription_failed_at) return { valid: false, reason: "subscription payment failed" };
  return { valid: true, reason: "ok" };
}

Python:

def evaluate(res):
    if not res or not res.get("success"):
        return {"valid": False, "reason": (res or {}).get("message", "invalid license")}
    p = res.get("purchase") or {}
    for flag in ("refunded", "chargebacked"):
        if p.get(flag):
            return {"valid": False, "reason": f"purchase {flag}"}
    if p.get("disputed") and not p.get("dispute_won"):
        return {"valid": False, "reason": "purchase disputed"}
    if p.get("subscription_ended_at") or p.get("subscription_failed_at"):
        return {"valid": False, "reason": "subscription inactive"}
    return {"valid": True, "reason": "ok"}

Two more tips

Send increment_uses_count=false on re-checks. By default every verify call bumps the key's uses count, so if you count activations, routine re-checks will burn through them. Only increment on the first activation.
Re-check now and then, not just once. Refunds happen after activation. A re-check every few days catches them. If you do this, cache the last good result so your app doesn't break offline.

Free code

I put both versions (zero dependencies, with tests) in a small MIT repo: https://github.com/NarwhalThePong/gumroad-license-check

If you want the production version, with a signed offline cache and grace period, activation limits, and a small proxy server so your product ID and logic stay off the client, I sell it as the Gumroad License Kit.

Have you hit other Gumroad API gotchas? Tell me in the comments.