GumroadCustomer payments

Set up Gumroad customer payments

This guide explains how to connect Gumroad for purchase checks, webhook events, and membership decisions. Gumroad only requires an access token in GramGrow.

Last updated: June 24, 2026

Important

Gumroad only requires the access token in GramGrow. There is no API secret for this setup path, and GramGrow does not store a separate webhook secret.

What Gumroad does in GramGrow

GramGrow uses Gumroad to map sales and payment changes to a contact, membership, or access target. The access token is used for API lookups. Webhook events keep later changes such as refunds, disputes, and subscription status changes up to date.

Good for

Purchase checks, membership sync, support cases, and manual access decisions.

Security boundary

Save only the Gumroad access token. No API secret and no webhook secret are required.

Create the access token

Open the developer or API settings in your Gumroad account.
Create or copy an access token for the account that sells the relevant products.
Store the token securely. GramGrow does not need an API secret value.
Paste the access token into GramGrow under Settings -> Payments and save the payment settings.

One credential only

If a form asks for an API secret or webhook secret, that is not part of the Gumroad setup in GramGrow. Leave those fields empty for Gumroad.

Webhooks and resource subscriptions

Gumroad webhooks are received per tenant in GramGrow. The technical URL has the form /webhooks/gumroad/:tenantId, but you should copy it from GramGrow so the tenant and public base URL are correct.

Webhook validation and resource subscriptions are handled through Gumroad API callbacks. When a public API base URL is configured, the backend best-effort registers the resource subscriptions automatically.

Gumroad webhook setup
URL: copied from GramGrow
Technical route: /webhooks/gumroad/:tenantId
Stored webhook secret: none
Events: sale, refund, dispute, dispute_won, cancellation, subscription_updated, subscription_ended, subscription_restarted

Fields in GramGrow

GramGrow field	What to enter	Purpose
Access Token	Access token from Gumroad	Required for API lookups, Purchase Checker, and subscription registration.
API secret	Leave empty	Gumroad does not require a separate API secret in GramGrow.
Webhook URL	Copy from GramGrow	Tenant-scoped target URL for Gumroad callbacks.
Webhook secret	Do not store	GramGrow does not store a webhook secret for Gumroad.

Verify the connection

Save the Gumroad access token in Settings -> Payments, then run the connection test. A successful test means GramGrow can reach Gumroad with the saved access token.

Expected setup result
Gumroad card: Connected
Access token: saved
API secret: empty
Webhook secret: not stored
Subscribed events: sale, refund, dispute, dispute_won, cancellation, subscription_updated, subscription_ended, subscription_restarted

Purchase Checker

After a successful connection, use Purchase Checker to verify a customer email. GramGrow calls Gumroad sales by email and excludes refunded sales so refunds do not count as valid purchase evidence.

Troubleshooting

GramGrow asks for an API secret or webhook secret

Leave it empty for Gumroad. GramGrow only needs the access token and does not store a webhook secret.

Connection test fails

Check that the access token belongs to the correct Gumroad account and was not truncated or pasted with whitespace.

Webhook events do not arrive

Copy the webhook URL from GramGrow again. The route is tenant-scoped and must be publicly reachable.

Resource subscriptions are not registered

Check whether a public API base URL is configured. Without a public URL, the backend cannot register Gumroad callbacks.

Purchase Checker finds no valid purchase

Check the email address and whether the sale was refunded. Refunded sales are intentionally excluded.

Next Steps

Open payment settings

Save the Gumroad access token in the workspace and verify the connection.

Purchase Checker

Check a customer email against Gumroad sales.