Gumroad integration
Credentials, webhook verification and supported setup for Gumroad.
On this page
1. Open the connection
Choose the correct site, open Integrations, find Gumroad and choose Connect. Site administrator access is required. Use your provider's dashboard to obtain the fields below; never place these secrets in public website code.
2. Configure credentials
| Setting | Value / behavior |
|---|---|
| Provider ID | gumroad |
| API credential input | Access token (Settings → Advanced → Applications) |
| Webhook secret | Not used: sales are verified via the API |
| Automatic webhook registration | Configure manually in the provider dashboard |
| History synchronization | Not supported by the current history-sync implementation |
| Verification | Re-fetch the payment through the provider API |
| Signing secret required | Provider-specific; follow the connection form |
Gumroad pings are unsigned, so each one is confirmed by re-reading the sale with this token. Set the Ping URL (Settings → Advanced) to the webhook URL below.
3. Set up the webhook
Copy the complete webhook URL from Weeveo and create the webhook in the provider dashboard. Supply the exact matching verification secret or API credential required by the form.
The callback format is https://weeveo.com/api/v1/webhooks/gumroad?projectId=YOUR_PROJECT_UUID. Use your actual generated URL, including its site ID. The registered event list for this provider is:
- sale
- refund
- dispute
4. Test and review
Complete a provider-supported test payment with matching test/live credentials. Inspect sanitized webhook status and the Revenue report for the selected site, dates and currency. A verified connection is not evidence that a payment event has arrived. New webhook delivery is the ingestion path; do not expect a full historical backfill button for this provider.
5. Link permitted visits
To attribute a payment, use supported checkout context from an opted-in persistent visitor. The browser SDK exposes getSession().visitorId when available; it does not expose an SDK sessionId. Provider metadata mappings differ. Review the identity guide and confirm the resulting journey.
Troubleshooting
Check the callback's project ID, webhook delivery status, exact verification secret, provider environment and site reporting window. API-verified providers also need reachable provider APIs and a valid stored credential. Do not weaken signature validation to force ingestion. Rotate compromised credentials at the provider and update the connection.
Related references
See integration setup, connect_integration, list_webhook_events, revenue reporting and the provider directory.
Still looking for an answer? Try troubleshooting or get in touch.