# Gumroad: L2 · Gets in As of 6 Oct 2026, an AI agent gets into Gumroad on its own and does 10% of the core work. Source: https://agentdrives.com/tools/gumroad?via=md · driven 6 Oct 2026 by AgentDrives's agent · 1 drive so far · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 Gets in on its own: L2 · Gets in. Sign-up is a web form, with no challenge, and account verification arrived by email. Getting a token needs one browser step, at Settings, Advanced, Applications; the official CLI's OAuth flow also needs a logged-in browser for the authorize click. From there our agent worked headless: calls to the REST API and the official MCP server created and read back products. Products stay drafts: publishing needs a payout method with identity verification, so no sale went through. There is no paid tier to cancel. Deleting the account, in Settings under Advanced, worked on its own, and the token stopped answering afterward. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L2 · Gets in: An agent gets in on its own, by any way the product offers: its own sign-up, a key by API, pay per call or no key at all. It does less than half the core work, or the work isn't measured yet. - Find: Some docs for agents (llms.txt and an MCP server) - Access: Sign-up in a browser - Use: 10% of the work - Pay: No plan to buy - Leave: Leaves on its own (Nothing to cancel, deletes its account) - Ways in: Sign-up in a browser, 1 of 10 core tasks - Next: do half of the core work (now 10%) - With an account set up by a person: not measured yet. ## Part scores - Agent-ready setup: llms.txt found, OpenAPI not found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match - Security: reported privately to the owner ## Who gets in - Agents on a server: Get in on their own. - Signed agents: The sign-up page opens. - Agents in a person's browser: Not measured yet. Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: llms.txt, /.well-known/mcp.json, PRM and AS metadata are plain JSON/text. The API reference at /api is a JS app: the HTML has no content, the text lives in the JS chunk (read headless). No OpenAPI file; Accept: text/markdown returns 404. - **Sign up**: In a browser: Web form only (email + password) at /signup; no CAPTCHA met; no sign-up API. - **Verify**: Headless: Confirmation mail arrived in about 1 minute. - **Key**: In a browser: Token from Settings > Advanced > Applications > Generate access token (web UI). The official CLI also does an OAuth device flow (gumroad auth login), but its Authorize click needs a logged-in browser session. - **First call**: Headless: GET /v2/user with the bearer token returned 200 with our account. - **First action**: Headless: POST /v2/products and MCP create_draft_product created products, read back with GET /v2/products/{id}. They stay drafts: publishing needs a payout method. - **Pay**: Not needed: There is no paid tier for sellers. /pricing: "Direct sales: 10% + 50¢ per sale, $0 monthly". No 402 on the API (401 Bearer), no /.well-known/ucp, no registry listing. x402./mpp./agents. subdomains are creator storefronts or 404. - **Cancel**: Not needed: Nothing to cancel: there is nothing to pay for. - **Delete**: In a browser: Settings > Advanced > Delete your Gumroad account, confirmed in a dialog. Web only. Afterwards the token answered 401 "The access token was revoked" and the storefront returned 404. ## Does Gumroad have an MCP server, and can an agent connect to it? Yes. Gumroad has an official MCP server. The server lists 8 tools, signs an agent in with OAuth and speaks the 26 Mar 2025 MCP spec. A new agent can get in on its own: in the drive of 6 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 1 of our agent's 3 attempts worked. ## How does an AI agent get a Gumroad API key? In the drive of 6 Oct 2026, our agent got its Gumroad API key in a browser, without a person. Token from Settings > Advanced > Applications > Generate access token (web UI). The official CLI also does an OAuth device flow (gumroad auth login), but its Authorize click needs a logged-in browser session. ## Paying the agent way No plan to buy. It has a free plan. From the drive of 6 Oct 2026. ## What an agent can do - Create draft digital products, memberships with a monthly tier, and bundles through the API, CLI or MCP - Edit, unpublish and delete products through the API - Upload a file and attach it to a product with the CLI - Add variants, discount codes, custom checkout fields and pay-what-you-want pricing through the API - Create a cross-sell upsell with the CLI - Update the seller name and bio, shown on the public storefront - Create and delete sale webhooks - Draft an audience email and send a preview to the seller's own inbox - Turn on authenticator-app 2FA by reading the setup key and computing the code - Export the sales CSV from the dashboard ## What it cannot do - Publish any product, even a free one: Publishing needs a payout method. That form asks for a PayPal email, legal name, home address, phone number, date of birth and an attestation of a government photo ID. - Sell anything: checkout, refunds, licenses, subscribers, gifts, embeds: No product can be published, so nothing can be bought - Send an email broadcast or publish a workflow: Gumroad requires at least $100 in sales and a payout first - Create commission, call or coffee (tip) products: "Service products are disabled until your account is 30 days old." - Create a physical product: This account has no physical product type, in the UI or the CLI - Add an affiliate: The affiliate must already have a Gumroad account - Get the first API token without a browser: Both routes (Generate access token, and approving a device code) need a logged-in web session ## Tips for the owner 1. Let drafts publish before payout setup 2. Add server/discover and 28 Jul 2026 to MCP 3. Return real HTTP status codes on errors 4. Publish an OpenAPI file and Markdown docs 5. Add account deletion to the API 6. Let agents mint a token without the dashboard Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in E-commerce - [Shopify](https://agentdrives.com/tools/shopify.md?via=md): L2 · Gets in · [Gumroad vs Shopify](https://agentdrives.com/compare/gumroad-vs-shopify?via=md) - [BigCommerce](https://agentdrives.com/tools/bigcommerce.md?via=md): L1 · Needs a person · [Gumroad vs BigCommerce](https://agentdrives.com/compare/bigcommerce-vs-gumroad?via=md) - [Ecwid](https://agentdrives.com/tools/ecwid.md?via=md): L1 · Needs a person · [Gumroad vs Ecwid](https://agentdrives.com/compare/ecwid-vs-gumroad?via=md) ## Tips for agent builders - Use the official CLI (curl -fsSL https://gumroad.com/install-cli.sh | bash). It covers more than the /api page: upsells, pages, file uploads in one command, and --json output. - The API token from Settings > Advanced > Applications also works as a Bearer token on the MCP endpoint https://gumroad.com/muse/v1/mcp. - Errors come back as HTTP 200 with success:false: check the success field, not the status. - The MCP server is legacy (initialize, protocol 2025-03-26); server/discover returns -32601. - Expect drafts only on a new account. Publishing needs a payout method with identity data, emails need $100 in sales, and service products need a 30-day-old account. - Deleted products still answer GET with deleted:true; filter on it. - Form-encode values with --data-urlencode: a literal + becomes a space.