Gumroad Ping not arriving at your webhook: checklist and fixes

Gumroad's Ping sends a POST to the URL you save in your Gumroad settings (Settings, Advanced, Ping) when a sale happens. If nothing arrives, go through this list:

1. The URL isn't saved, or isn't public. localhost and private IPs can't be reached from Gumroad. Use a public https:// URL, or a tunnel while testing.
2. Your handler expects JSON. Ping bodies are application/x-www-form-urlencoded, so express.json() sees an empty body. Use express.urlencoded({ extended: true }) (or request.form in Flask).
3. Your endpoint returns an error (a 4xx/5xx, a redirect, or a timeout). Return 200 quickly and do slow work afterwards.
4. Testing without a sale. Use the send-test-ping option next to the Ping URL setting if your account shows it, or make a $0 or discounted test purchase of your own product.

Is a ping really from Gumroad?

Pings aren't signed. Before granting access, confirm the sale yourself. For example, check the buyer's license key with Gumroad's public license verification endpoint, or look the sale up through the Gumroad API using its sale_id.

Express

app.post('/gumroad', express.urlencoded({ extended: true }), (req, res) => {
  const { sale_id, product_id, email, license_key } = req.body;
  res.sendStatus(200);           // acknowledge fast
  // then verify license_key / sale_id before granting access
});