Gumroad License Kit: Drop-in License Key Verification for Python, Node & Browser Apps

Selling software on Gumroad? Verifying license keys looks like a 5-line job, until a refunded customer keeps using your app.

Gumroad's verify API returns success: true even for refunded and chargebacked purchases. The use counter goes up on every check by default, and browser calls fail on CORS. This kit handles all of that out of the box:

✅ Rejects refunds, chargebacks, lost disputes, and ended or failed subscriptions

✅ verify() never inflates the use count, and activate() increments it once

✅ Offline grace period (14 days by default) with an HMAC-signed cache bound to the key. The raw key is never stored.

✅ Revocation wipes the cache immediately

✅ A small CORS proxy for browser, Electron, and Tauri apps that never exposes buyer emails

✅ Python (stdlib only) and Node 18+ (zero dependencies), plus a CLI

✅ 17 passing unit tests, MIT license, OK to use in commercial products

What you get: a ZIP with python/, node/, proxy/, tests, a README, and the LICENSE.

Honest note: client-side checks stop casual key sharing and refund abuse, not determined crackers. Tested against Gumroad's public API docs. Not affiliated with Gumroad.