sales-skills/sales-sendowl

SendOwl Platform Help

SendOwl sells and securely delivers digital products — download links with expiry/limits, PDF stamping, license keys, drip content, subscriptions, bundles, and upsells — with a REST API and HMAC-signed webhooks.

Step 1 — Gather context

If references/learnings.md exists, read it first for accumulated platform knowledge.

Ask only what you can't infer from the user's message:

1. What are you trying to do?

   • A) Stop customers from sharing download links / tighten delivery security
   • B) Build an API or webhook integration (sync orders to a CRM, warehouse, Slack, or your own app)
   • C) Set up products, subscriptions, drip, license keys, or upsells
   • D) Compare SendOwl plans/pricing to alternatives, or weigh a price change
   • E) Troubleshoot a broken flow (webhook not firing, email not sending, file not delivering)

2. Are you connecting SendOwl to another tool? Which one, and which direction should data flow?

Skip-ahead rule: if the user's prompt already contains enough context, skip to Step 2.

Step 2 — Route or answer directly

Map the request to the right home. When routing, give the exact command.

| The user's need | Route to | |-----------------|----------| | "Which platform should I sell on — SendOwl, Gumroad, Payhip?" | /sales-digital-products {question} | | Checkout-conversion strategy (order bumps, upsells, cart abandonment) across carts | /sales-checkout {question} | | VAT/GST/sales-tax handling for global sales (SendOwl is not a merchant of record) | /sales-merchant-of-record {question} | | Pricing/packaging strategy for the product itself | /sales-digital-products {question} | | Recurring-access / course-membership strategy | /sales-membership {question} | | Wiring SendOwl events into other tools via an iPaaS | /sales-integration {question} |

If it's a SendOwl setup, API, webhook, delivery-security, or pricing question, answer it here using Step 3.

Step 3 — SendOwl platform reference

Read references/platform-guide.md for the full platform reference — capabilities and automation surface, pricing/plan gates, data model, integration recipes (order→CRM sync, webhook listener, license issuing), and code examples.

For raw endpoint details, request/response JSON, auth, pagination, and the webhook payload schema, read references/sendowl-api-reference.md.

Answer using only the relevant section — don't dump the full reference.

Step 4 — Actionable guidance

You no longer need the platform guide — focus on the user's situation.

• Delivery security first: for shared-link complaints, layer defenses — set download-limit + link-expiry on the product, turn on PDF stamping for ebooks, and issue license keys for software. No single control stops sharing alone.
• Trust webhooks over polling for order events, but always verify the X-SENDOWL-HMAC-SHA256 signature against the raw request body before acting, and make handlers idempotent (retries send duplicates).
• Respect the rate limit: ~1 request/second or the IP can be blocked. For bulk exports, page with per_page=50 and sleep between calls; contact support for higher throughput.
• Read the order state from the payload, the event from the header — SendOwl sends the order's current state in the body and the trigger in X-SENDOWL-EVENT.
• Model annual sales/orders, not just features — plans cap orders/year and sales/year; crossing a cap forces an upgrade.

If you discover a gotcha, workaround, or tip not covered in references/learnings.md, append it there with today's date.

Gotchas

Best-effort from research (2026-07) — review these, especially plan-gated features and pricing that may be outdated.

• SendOwl hosts links, not files — it stores download links (historically capped around 250 files), not unlimited raw file hosting. For large media libraries, host the file elsewhere (S3/Bunny/Cloudflare) and deliver the link through SendOwl.
• Download protection is a deterrent, not a lock — expiring/limited links + PDF stamping + license keys reduce casual sharing but don't stop a determined re-uploader. Gate high-value access off the order_completed webhook in your own app.
• Webhooks POST raw JSON (order "Liquid"), not form params — read the raw request body to parse it, and compute the HMAC over that exact raw body.
• Rails header renaming — the signature arrives as HTTP_X_SENDOWL_HMAC_SHA256, not X_SENDOWL_HMAC_SHA256.
• Version-split paths — most resources are /api/v1/... but orders live at /api/v1_3/orders; mixing versions returns unexpected results.
• Abrupt repricing risk — reviewers report large, short-notice price increases. Keep an export/migration path ready and don't hard-code a single-vendor dependency.
• check_valid license endpoint leaks credentials if embedded — never call it from shipped client software; validate server-side.

Related skills

• /sales-digital-products — Digital product strategy: pricing, launch, delivery, and platform selection across tools. Install: npx skills add sales-skills/sales --skill sales-digital-products -a claude-code
• /sales-checkout — Checkout-conversion strategy (order bumps, upsells, cart abandonment) across carts. Install: npx skills add sales-skills/sales --skill sales-checkout -a claude-code
• /sales-merchant-of-record — Global tax handling via a merchant of record (SendOwl is not one). Install: npx skills add sales-skills/sales --skill sales-merchant-of-record -a claude-code
• /sales-gumroad — Gumroad platform help (a common SendOwl alternative). Install: npx skills add sales-skills/sales --skill sales-gumroad -a claude-code
• /sales-do — Not sure which skill to use? The router matches any sales objective to the right skill. Install: npx skills add sales-skills/sales --skill sales-do -a claude-code

Examples

Example 1: Customers are sharing my download link

User says: "People are passing around the download link to my $49 course PDF — how do I lock it down in SendOwl?" Skill does: Explains layering — set a download limit and link expiry on the product, enable PDF stamping so each copy carries the buyer's name/email, and (for software) issue license keys. Notes that true access-gating means validating the order_completed webhook in the user's own app, since links can still be re-shared. Result: User applies limit + expiry + stamping and understands the deterrent-vs-lock tradeoff.

Example 2: Sync completed orders into a CRM via the API/webhook

User says: "How do I push every completed SendOwl sale into HubSpot automatically?" Skill does: Recommends the order_completed webhook over polling; walks through verifying X-SENDOWL-HMAC-SHA256 against the raw body with the signing-key secret, parsing the raw-JSON order payload (buyer name/email/country, cart items, transactions), and upserting to the CRM idempotently. Gives the polling fallback (GET /api/v1_3/orders?updated_after=) for reconciliation. Result: User has a signed, idempotent listener plus a catch-up poller.

Example 3: order_completed webhook isn't firing

User says: "My SendOwl webhook never hits my endpoint when a sale completes." Skill does: Checks the webhook is enabled and the event is Order completed (not just New payment), confirms the URL returns 2XX/3XX (SendOwl retries 10× with backoff on failures), verifies HTTPS reachability, and confirms the handler reads the raw body rather than parsed form params. Result: User fixes the event selection / response code and receives events.

Troubleshooting

Download links are being shared

Symptom: Buyers forward the download URL and others download for free. Cause: Default links have generous or unset limits; nothing ties a link to a person. Solution: Set per-product download-limit + link-expiry, enable PDF stamping (embeds buyer identity), and use license keys for software. For real gating, deliver via your own app keyed off the purchase webhook. If you reset a buyer's access, PUT /api/v1/orders/{id}/download_restrictions.

Webhook signature verification keeps failing

Symptom: Computed HMAC never matches X-SENDOWL-HMAC-SHA256. Cause: Hashing a re-serialized/parsed body instead of the raw request, wrong secret, or framework-renamed header. Solution: Compute HMAC-SHA256 over the raw request body using the Signing Key Secret from the API settings page, base64-encode, and compare to the header. In Rails read request.raw_post and HTTP_X_SENDOWL_HMAC_SHA256.

Hitting rate limits / IP blocked during export

Symptom: Requests start failing or the IP is blocked when pulling many orders/products. Cause: Exceeding ~1 request/second. Solution: Throttle to ≤1 req/sec, page with per_page=50&page=N, and use updated_after to pull only changed orders. Contact SendOwl support to request a higher limit for legitimate bulk jobs.