First-party app
Gumroad Gumroad

Gumroad

Manage Gumroad products, sales, subscribers, licenses, offer codes and payouts, and subscribe to sale webhooks.

stable Commerce & Payments

About

Gumroad ships in the w6w first-party pack. It declares 53 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.gumroad
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Commerce & Payments

Overview

Gumroad is where creators sell digital products, courses, memberships and coffee-tip pages without running a store. This app gives a workflow the seller’s side of that: read and edit the product catalogue, pull sales and refund, revoke or restore a buyer’s access, list memberships and their subscribers, and manage the license keys that gate your software.

It also covers the merchandising levers around a product — variant categories and variants, offer codes, and checkout custom fields — plus the account-level refund policy, payouts, and the annual earnings summary.

For event-driven flows, resource subscriptions register a URL that Gumroad POSTs to on a sale, refund, dispute, cancellation or subscription change, so a workflow reacts instead of polling.

Build with Gumroad

Three routes to the same 53 actions. The Workflow tab is generated from Gumroad's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

List Categories

category-list

The full product category list; use a category's `path` as Category when creating or updating products.

Create Custom Field

custom-field-create

Add a checkout field to a product. Needs the `edit_products` or `account` scope.

Delete Custom Field

custom-field-delete

Permanently delete a custom field. Needs the `edit_products` or `account` scope.

List Custom Fields

custom-field-list

List the extra checkout fields a product collects from buyers.

Update Custom Field

custom-field-update

Change whether a custom field is required. Needs the `edit_products` or `account` scope.

Get Annual Earnings

earnings-get

Gross, fees, taxes and net for a tax year, matching the Tax Center. US sellers with the tax center enabled only; 404 outside the account's available years. Needs the `view_tax_data` or `account` scope.

Decrement License Uses

license-decrement-uses-count

Decrease a license key's use counter by one. Needs the `edit_sales` or `account` scope.

Disable License

license-disable

Disable a license key so it no longer verifies. Needs the `edit_sales` or `account` scope.

Enable License

license-enable

Re-enable a disabled license key. Needs the `edit_sales` or `account` scope.

Rotate License Key

license-rotate

Issue a new key for a license. The old key stops being valid. Needs the `edit_sales` or `account` scope.

Verify License

license-verify

Check a license key. Gumroad's own default INCREMENTS the key's use counter on every call; this action defaults Increment uses count to false so a check has no side effect.

Create Offer Code

offer-code-create

Create an offer code. Amount off is in cents unless Offer type is percent. Needs the `edit_products` or `account` scope.

Delete Offer Code

offer-code-delete

Permanently delete an offer code. Needs the `edit_products` or `account` scope.

Get Offer Code

offer-code-get

Fetch one offer code.

List Offer Codes

offer-code-list

List a product's offer codes. Each has `amount_cents` or `percent_off`; universal codes apply to all products.

Update Offer Code

offer-code-update

Change an offer code's usage cap or minimum order amount. The code and discount itself cannot be edited. Needs the `edit_products` or `account` scope.

Get Payout

payout-get

One payout with its sales (and optionally per-transaction rows). Needs the `view_payouts` or `account` scope.

List Payouts

payout-list

The seller's payouts, newest first. Needs the `view_payouts` or `account` scope.

List Upcoming Payouts

payout-upcoming

Up to two upcoming payouts. Needs the `view_payouts` or `account` scope.

Create Product

product-create

Create a product. It is published immediately unless Published is false or Save as draft is set. Needs the `edit_products` or `account` scope.

Delete Product

product-delete

Permanently delete a product. Needs the `edit_products` or `account` scope.

Unpublish Product

product-disable

Disable (unpublish) a product. Needs the `edit_products` or `account` scope.

Publish Product

product-enable

Enable (publish) a product. Needs the `edit_products` or `account` scope.

Get Product

product-get

Fetch one product, including variants, tiers and custom_html.

List Products

product-list

List every product of the authenticated seller. Needs the `view_profile` or `account` scope.

Update Product

product-update

Update a product. Send only the fields to change; Tags replace the whole set. Needs the `edit_products` or `account` scope.

Get Refund Policy

refund-policy-get

The account-level refund policy.

Update Refund Policy

refund-policy-update

Update the account-level refund policy. Rejected when the account-level policy is not in effect; then set it per product. Needs the `edit_products` or `account` scope.

Subscribe to Resource

resource-subscription-create

Register a URL that Gumroad POSTs to when the resource event happens (a sale needs the view_sales scope). Gumroad documents this as PUT. Needs the `view_sales` or `account` scope.

Unsubscribe from Resource

resource-subscription-delete

Delete a resource subscription.

List Resource Subscriptions

resource-subscription-list

Active webhook subscriptions for one resource type.

List Product Reviews

review-list

Reviews shown on a product page, newest first, up to 100 per page. Star-only ratings with no message are not returned.

Get Sale

sale-get

Fetch one sale. Needs the `view_sales` or `account` scope.

List Sales

sale-list

Successful sales, newest first, with filters. Paginated via Page key. Needs the `view_sales` or `account` scope.

Mark Sale Shipped

sale-mark-shipped

Mark a physical-product sale as shipped. Needs the `mark_sales_as_shipped` or `account` scope.

Refund Sale

sale-refund

Refund a sale, fully or partially. Not safe to retry: a repeated partial refund may refund again. Needs the `edit_sales` or `account` scope.

Resend Receipt

sale-resend-receipt

Email the purchase receipt to the customer again. Needs the `edit_sales` or `account` scope.

Revoke Sale Access

sale-revoke-access

Remove the buyer's access without refunding. Refused for refunded sales, physical products and subscriptions. Needs the `edit_sales` or `account` scope.

Restore Sale Access

sale-undo-revoke-access

Restore a buyer's access that was previously revoked. Needs the `edit_sales` or `account` scope.

Get Subscriber

subscriber-get

Fetch one subscriber. `status` is one of alive, payment_method_update_required, pending_cancellation, pending_failure, failed_payment, fixed_subscription_period_ended, cancelled. Needs the `view_sales` or `account` scope.

List Subscribers

subscriber-list

Subscribers of a membership product. Without Paginated, Gumroad returns ALL of them in one response. Needs the `view_sales` or `account` scope.

List Tax Forms

tax-form-list

1099-K / 1099-MISC forms for the seller. US sellers with the tax center enabled only. Needs the `view_tax_data` or `account` scope.

Get User

user-get

The authenticated seller's profile: name, bio, user_id, public url (and email, with the view_sales scope).

Create Variant Category

variant-category-create

Create a variant category on a product. Needs the `edit_products` or `account` scope.

Delete Variant Category

variant-category-delete

Permanently delete a variant category. Needs the `edit_products` or `account` scope.

Get Variant Category

variant-category-get

Fetch one variant category.

List Variant Categories

variant-category-list

List a product's variant categories (e.g. sizes, colors, tiers).

Update Variant Category

variant-category-update

Rename a variant category. Needs the `edit_products` or `account` scope.

Create Variant

variant-create

Create a variant in a variant category. Needs the `edit_products` or `account` scope.

Delete Variant

variant-delete

Permanently delete a variant. Needs the `edit_products` or `account` scope.

Get Variant

variant-get

Fetch one variant.

List Variants

variant-list

List the variants in a variant category.

Update Variant

variant-update

Edit a variant. Needs the `edit_products` or `account` scope.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Gumroad's real ids.

{
  "manifestVersion": "2",
  "name": "gumroad-example",
  "steps": [
    {
      "id": "custom-field-create",
      "uses": {
        "app": "io.w6w.gumroad",
        "action": "custom-field-create",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "productId": "<productId>",
        "name": "<name>"
      }
    }
  ]
}

Here are some of the things you can do

  • Create Custom Field

    perform
    custom-field-create
  • List Categories

    read
    category-list
  • List Custom Fields

    read
    custom-field-list
  • Update Custom Field

    perform
    custom-field-update
  • Get Annual Earnings

    read
    earnings-get

+48 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Gumroad, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Gumroad. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "custom-field-create",
  payload: {
    productId: "<value>",
    name: "<value>",
    // required: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action custom-field-create --payload '{"productId":"<value>","name":"<value>"}'

Give an AI agent Gumroad — without giving it Gumroad's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.gumroad#custom-field-create",
    "input": {
      "productId": "<productId>",
      "name": "<name>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Gumroad connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Gumroad's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Gumroad itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Gumroad declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Platform status

quota

API request headroom