How to verify Gumroad license keys in an Electron app (and the 3 gotchas nobody warns you about)

Source: Dev.to

If you sell a desktop app on Gumroad, it hands every buyer a license key. But Gumroad stops there — checking that key inside your app is entirely up to you. Here’s how to do it properly in Node/Electron, plus the three traps that catch almost everyone. We’ll use gumroad-license-lite, a tiny, zero-dependency, MIT-licensed helper (you can npm install it or just copy its ~120 lines). Turn on license keys in Gumroad

Verify a key

const result = await verifyGumroadLicense({ if (result.valid) { Gate your app on launch You don’t want to call Gumroad on every launch, and you want the app to survive a flaky connection. LicenseGate caches the result and re-checks periodically: const path = require(‘node:path’); const gate = new LicenseGate({ // on your activation screen: // on every launch: “Valid” isn’t the same as “exists.” A refunded or charged-back sale still has a real, working key. If you only check that the key exists, people can buy, copy the key, refund, and keep your app forever. Always check the refund / dispute / subscription flags (the helper above does this for you).

The uses counter is global, not per-device. Gumroad tracks a uses count, but it can’t tell you which machines — so you can’t actually enforce “3 devices per license.” One key can quietly unlock a hundred installs.

Offline means locked out. A pure online check fails the moment your user has no internet — on a plane, on hotel wifi — and your paying customer can’t open the app. A local cache (like above) softens this, but a plain JSON cache is editable, so it’s friction-reduction, not real protection.

When you outgrow the basic check TL;DR https://github.com/apecollective/gumroad-license-lite How do you handle licensing for the apps you sell on Gumroad? Genuinely curious what others are doing.