Step 1 — Gather context
If references/learnings.md exists, read it first for accumulated platform knowledge.
-
What are you trying to do?
- A) Grant product/course access (or revoke) from purchase events via webhook/API
- B) Route purchases into a CRM/ESP (Zapier or native integration)
- C) Understand pricing — Standard vs Pro+ vs Ultimate, the $295/yr renewal, what's gated
- D) Deal with ThriveCart Learn deprecation (move courses to ThriveAcademy or an external LMS)
- E) Configure a module — bumps, upsells/downsells, A/B test, dunning, affiliate center
- F) Fix a problem — webhook auth, duplicate orders, missing features, no download protection
-
Webhook or REST? Reacting to a purchase → webhooks (standard = all events; Event Subscription API = targeted). Pulling/reconciling history → REST API (token, 60 req/min).
Skip-ahead rule: if the user's prompt already provides enough context, skip to Step 2.
Step 2 — Route or answer directly
| If the question is about... | Route to... |
|---|---|
| Checkout-conversion strategy across tools (which cart, AOV optimization) | /sales-checkout {question} |
| Course/membership strategy or picking an LMS (Learn replacement) | /sales-membership {question} |
| Designing an affiliate program across tools (commissions, recruiting) | /sales-affiliate-program {question} |
| Subscription churn / dunning strategy across tools | /sales-membership {question} |
| Connecting ThriveCart to other tools generically (iPaaS) | /sales-integration {question} |
When routing, give the exact command, e.g. "This is a cart-selection question — run: /sales-checkout ThriveCart vs SamCart for my course business".
Step 3 — ThriveCart platform reference
Read references/platform-guide.md for the full reference — the module map (what's API/webhook vs UI-only), the lifetime-pricing model with the Pro+ $295/yr renewal and what each tier gates, the order/subscription data model with JSON shapes, and quick-start recipes (grant access on purchase; send orders to a CRM; reconcile via REST).
Read references/thrivecart-api-reference.md for the integration surface — API-token vs OAuth auth, the 60 req/min limit, standard webhooks vs the Event Subscription API, the event-type list (order.success, order.subscription_*, affiliate.*), the webhook payload shape, and secret-based webhook validation (no HMAC).
Answer using only the relevant section. Don't dump the full reference.
Step 4 — Actionable guidance
Focus on the user's specific situation:
- Drive everything off purchase events. Grant access on
order.success; revoke onorder.refund/order.subscription_cancelled. Use standard webhooks for everything, or the Event Subscription API to receive only the events you care about. - Validate the secret — there's no HMAC. ThriveCart authenticates webhooks with a shared
thrivecart_secretyou configure; reject any POST whose secret doesn't match, keep it private, and dedupe onorder_idsince events can repeat. - Match on product id, not name. Names change; the numeric
base_product(and bump/upsell ids) are stable. - "Lifetime" has a $295/yr asterisk. Affiliates, sales tax, dunning, custom checkout domain, and advanced reporting are Pro+ ($295/yr from year 2). Standard is genuinely one-time but minimal — budget the renewal.
- Don't build on ThriveCart Learn. It's deprecated (no new features) — deliver courses via ThriveAcademy
or grant access to an external LMS off the purchase webhook. (LMS choice →
/sales-membership.) - Protect delivery yourself. ThriveCart has no download/link protection — gate files behind login in your own app/LMS rather than emailing a shareable link.
If you discover a gotcha, workaround, or tip not covered in references/learnings.md, append it there.
Gotchas
Best-effort from research (2026-06) — review these, especially pricing and the Learn deprecation, which change.
- "Lifetime" isn't fully lifetime. Pro+ (affiliates, tax, dunning, custom domain, advanced reporting) renews at $295/yr from year 2 — model real cost, not just the one-time headline.
- ThriveCart Learn / Learn+ are deprecated. No new features; ThriveAcademy replaces them. Don't build new course delivery on Learn.
- No download/link protection. Delivered file links can be shared freely — gate real access in your own app off
order.success. - Webhook auth is a shared secret, not HMAC. Validate
thrivecart_secreton every call and keep it private; there's no signature header. - Events can repeat — dedupe on
order_id. Don't double-provision; make handlers idempotent. - Standard plan is bare. No affiliate center, sales tax, dunning, or custom checkout domain — those need Pro+.
- 60 requests/minute per account on the REST API — batch/reconcile within that, back off on limits.
- History of instability + billing bugs. Ownership changes caused past downtime/Stripe issues; reportedly stabilized, but test the full purchase + billing flow before a launch.
Related skills
/sales-samcart— SamCart platform help (the subscription-priced competitor: modern templates, Subscription Saver dunning, Affiliate Center on Pro; $79–199/mo vs ThriveCart's lifetime license)/sales-checkout— Checkout-conversion strategy across tools (ThriveCart vs SamCart vs Lemon Squeezy; order bumps, upsells, cart recovery)/sales-membership— Course/membership strategy + picking an LMS (the ThriveCart Learn replacement decision)/sales-affiliate-program— Designing an affiliate program across tools — pairs with ThriveCart's built-in Affiliate Center (Pro+)/sales-email-marketing— Post-purchase email sequences off ThriveCart purchase events/sales-do— Not sure which skill to use? The router matches any sales objective to the right skill. Install:npx skills add sales-skills/sales --skill sales-do -a claude-code
Examples
Example 1: Grant course access when someone buys (developer/automation)
User says: "When someone buys my course on ThriveCart, auto-enroll them in my external LMS."
Skill does: Walks Recipe 1 — handle the order.success webhook, validate the thrivecart_secret (no HMAC), then grant access by the buyer's email + numeric base_product (match on id, not name); revoke on order.refund/order.subscription_cancelled. Notes deduping on order_id, using the Event Subscription API to receive only order.success, and that ThriveCart Learn is deprecated so an external LMS or ThriveAcademy is the path.
Result: Purchases auto-enroll buyers reliably.
Example 2: Why is my "lifetime" cart asking for $295/year?
User says: "I bought ThriveCart as a one-time deal — why am I being charged $295/year now?" Skill does: Explains the 2025 model change — the base Standard ($495) is one-time, but the creator essentials (affiliate center, sales tax, dunning, custom checkout domain, advanced reporting) are Pro+, which renews at $295/yr from year 2. Helps them decide whether they need Pro+ features or can stay on Standard, and frames pricing as best-effort to verify live. Result: User understands the real cost structure.
Example 3: My customers are sharing the download link
User says: "People are passing around the file link to my paid PDF from ThriveCart."
Skill does: Identifies that ThriveCart has no download/link protection — a known limitation. Recommends gating the file behind login in your own app/membership/LMS, granting access off the order.success webhook (and revoking on refund), rather than delivering a raw shareable link. Routes membership/LMS setup to /sales-membership.
Result: Files are protected behind authenticated access tied to the purchase.
Troubleshooting
My webhook fires but I can't trust it / anyone could POST to it
Symptom: You're unsure a webhook really came from ThriveCart.
Cause: ThriveCart doesn't sign webhooks with HMAC — authenticity is a shared secret you set in the webhook config.
Solution: Configure a secret on the notification, and on every inbound POST reject any request whose thrivecart_secret doesn't match. Keep the secret out of client code/logs. Also dedupe on order_id so retries don't double-provision.
Access isn't granted (or is granted twice) on purchase
Symptom: Buyers don't get access, or get provisioned multiple times.
Cause: Listening to the wrong event, matching on product name (which changes), or not handling repeated deliveries.
Solution: Grant on order.success (revoke on order.refund/order.subscription_cancelled), match the offer by the stable numeric base_product/bump/upsell id, and make the handler idempotent on order_id. Reconcile periodically via the REST API to catch missed webhooks (mind the 60/min limit).
Features I expected are missing / it's costing more than "lifetime"
Symptom: No affiliate center, tax, dunning, or custom domain; surprise annual charge. Cause: You're on Standard (those are Pro+), and Pro+ renews $295/yr from year 2 — the "lifetime" deal is partial. Solution: Upgrade to Pro+ for affiliates/tax/dunning/custom-domain/advanced reporting if you need them, and budget the $295/yr. If your courses are on Learn, plan a move to ThriveAcademy or an external LMS, since Learn is deprecated.