Selling digital downloads from a static site, with no backend of your own
A static site, a merchant of record and a payment link make a complete shop for a digital product. What each part does, and three places it still goes wrong.
This store has no application server, no database and no card data. It is prerendered HTML on a CDN, and it takes real payments. The shape is simple enough to copy.
The four parts
| Part | Job |
|---|---|
| Static site | Product pages, and a Buy button that is just a link |
| Hosted checkout | Takes the card, handles 3-D Secure and fraud checks |
| Merchant of record | Is the legal seller: calculates and remits tax, issues invoices |
| Entitlements | Releases the file and a licence key only after payment succeeds |
The Buy button is a static payment link with the product id in it and a return URL. No secret is involved, because nothing about a payment link needs one.
Where it still goes wrong
- Shipping a test checkout to production. A test-mode checkout only accepts test cards, so real buyers fail silently. We made the build refuse to produce an indexable site in test mode. More in test-mode checkout pitfalls.
- Relying on email alone. Download links in email expire, and people mistype addresses. Show the licence key on the return page and let them download there too.
- Trusting the return URL.
?status=succeededcan be typed by anyone. It may change what the page says; it must never release a file.
The one piece of code we did add
Downloading on the site needs something to check a licence key before handing over a file. We added exactly one route for that, and nothing else, described in licence-key gated downloads. Everything else stayed static.
Questions
Can I sell a digital product from a static site?
Yes. A hosted checkout handles payment, a merchant of record handles tax, and the provider delivers the file after payment. Your site only needs to link to the checkout and show a page afterwards.
How does the buyer get the file?
The payment provider emails a download link and usually offers a customer portal. We also show the buyer a licence key on the page they return to, so a mistyped email address does not lose them the purchase.
Do I need a server to check that a payment succeeded?
Not for delivery, because the provider only releases the file after a successful payment. Never release files based on a status parameter in the return URL; anyone can type one.