A product can have one custom HTML landing page, stored in its custom_html field. While it's set and
the product is published, buyers see it instead of the default product page. Authenticate with a Bearer token that
has the edit_products scope.
GET /v2/products/:id returns the custom_html field.
PUT /v2/products/:id sets it; send null or an empty string to clear it.
POST /v2/products/:id/preview_custom_html returns the sanitized HTML and a sanitization report
without saving — use it to iterate before you publish.
PUT and preview return a sanitization_report listing what was stripped.
PUT and preview return a top-level warning if the custom HTML has no{" "}
data-gumroad-action="buy" element or gumroad:checkout postMessage.
PUT also returns previous_custom_html (the prior value, for one-step
rollback) and the live landing_url.
target="_blank" needed. Links to other sites still open in a new tab.
PUTs/min, 60 previews/min.
Your HTML is sanitized — disallowed tags and attributes are stripped — then served inside a sandboxed iframe (
sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox"
).
It can:
It can't:
allow-downloads, so a link to a PDF, zip, or any other file the
browser would download is cancelled — silently, with no error anywhere, so the link just looks dead.{" "}
target="_blank" does not work around it. Deliver the file as product content and link to
the product instead.
fetch, XHR, or WebSocket requests (connect-src 'none').
action attributes are stripped.
Every external load is restricted to Gumroad's CDN (images and media) or the named font and script CDNs above, so the page has no arbitrary-host network channel — it can't beacon data off to a server you control.
Mark elements with data attributes that Gumroad fills in server-side so the page always shows current values and a working checkout button:
data-gumroad-field="name|price|description|rating|review-count" — the element's contents are
replaced with the product's current value (HTML-escaped). price is the amount a first-time buyer
pays: your default offer code is applied, and a membership is quoted at its default recurrence — matching the
native product page this HTML replaces. rating and review-count leave the element's
existing contents alone when reviews are hidden on the product or it has none yet, so write your own fallback
text inside them.
data-gumroad-action="buy" — wires the element up to launch the Gumroad checkout. Works on any tag (
<a>, <button>, <div>).
For products with selection state, set the choice directly on the buy element. Invalid values silently fall back to the product defaults — they won't break the page.
data-gumroad-option="<variant name>" — products with variants/versions/tiers.
data-gumroad-quantity="<integer>" — products with quantity enabled.
data-gumroad-price="<decimal>" — pay-what-you-want products; major units (e.g.{" "}
"9.99").
data-gumroad-recurrence="monthly|quarterly|biannually|yearly|every_two_years" —
membership/subscription products.
draft=true or{" "}
published=false. If publishing is blocked (for example, your email address is not confirmed or no
payout method is set up), the product is saved as a draft and the response includes a warning{" "}
explaining why; publish it later with POST /v2/products/:id/enable. Requires the{" "}
edit_products or account scope.
}
>
Cover images and thumbnails are attached separately via POST /v2/products/:id/covers and{" "}
POST /v2/products/:id/thumbnail.
files,{" "}
tags, or rich_content replaces the entire collection. Requires the{" "}
edit_products or account scope.
}
>