ThriveCart (thrivecart.com) platform help — checkout/cart platform for creators selling digital products, courses & subscriptions — order bumps, 1-click upsells/downsells, A/B testing, dunning, and a built-in affiliate center; sold as a lifetime (one-time) license. Event-driven — standard webhooks + an Event Subscription API and a REST API (token/OAuth, 60 req/min); webhook auth is a shared secret (order.success and subscription events), not HMAC. Use when granting product/course access on an order.success webhook, the 'lifetime deal' surprising you with an annual Pro+ renewal, affiliate/tax/dunning/custom-domain features missing on Standard, ThriveCart Learn being deprecated (move to ThriveAcademy/external LMS), files shared because there's no download protection, or choosing Standard vs Pro+ vs Ultimate. Do NOT use for checkout-conversion strategy across tools (use /sales-checkout), course/membership strategy (use /sales-membership), or affiliate-program design across tools (use /sales-affiliate-program).
ThriveCart (thrivecart.com) platform help — checkout/cart platform for creators selling digital products, courses & subscriptions — order bumps, 1-click upsells/downsells, A/B testing, dunning, and a built-in affiliate center; sold as a lifetime (one-time) license. Event-driven — standard webhooks + an Event Subscription API and a REST API (token/OAuth, 60 req/min); webhook auth is a shared secret (order.success and subscription events), not HMAC. Use when granting product/course access on an order.success webhook, the 'lifetime deal' surprising you with an annual Pro+ renewal, affiliate/tax/dunning/custom-domain features missing on Standard, ThriveCart Learn being deprecated (move to ThriveAcademy/external LMS), files shared because there's no download protection, or choosing Standard vs Pro+ vs Ultimate. Do NOT use for checkout-conversion strategy across tools (use /sales-checkout), course/membership strategy (use /sales-membership), or affiliate-program design across tools (use /sales-affiliate-program).
argument-hint
[describe what you need help with in ThriveCart]
license
MIT
version
1.0.0
tags
["sales","checkout","payments","platform"]
github
https://github.com/thrivecart
ThriveCart Platform Help
Step 1 — Gather context
If references/learnings.md exists, read it first for accumulated platform knowledge.
What are you trying to do?
A) Grant product/course access (or revoke) from purchase events via webhook/API
B) Route purchases into a CRM/ESP (Zapier or native integration)
C) Understand pricing — Standard vs Pro+ vs Ultimate, the $295/yr renewal, what's gated
D) Deal with ThriveCart Learn deprecation (move courses to ThriveAcademy or an external LMS)
E) Configure a module — bumps, upsells/downsells, A/B test, dunning, affiliate center
F) Fix a problem — webhook auth, duplicate orders, missing features, no download protection
Webhook or REST? Reacting to a purchase → webhooks (standard = all events; Event Subscription API = targeted). Pulling/reconciling history → REST API (token, 60 req/min).
Skip-ahead rule: if the user's prompt already provides enough context, skip to Step 2.
Step 2 — Route or answer directly
If the question is about...
Route to...
Checkout-conversion strategy across tools (which cart, AOV optimization)
/sales-checkout {question}
Course/membership strategy or picking an LMS (Learn replacement)
/sales-membership {question}
Designing an affiliate program across tools (commissions, recruiting)
/sales-affiliate-program {question}
Subscription churn / dunning strategy across tools
/sales-membership {question}
Connecting ThriveCart to other tools generically (iPaaS)
/sales-integration {question}
When routing, give the exact command, e.g. "This is a cart-selection question — run: /sales-checkout ThriveCart vs SamCart for my course business".
Step 3 — ThriveCart platform reference
Read references/platform-guide.md for the full reference — the module map (what's API/webhook vs UI-only), the lifetime-pricing model with the Pro+ $295/yr renewal and what each tier gates, the order/subscription data model with JSON shapes, and quick-start recipes (grant access on purchase; send orders to a CRM; reconcile via REST).
Read references/thrivecart-api-reference.md for the integration surface — API-token vs OAuth auth, the 60 req/min limit, standard webhooks vs the Event Subscription API, the event-type list (order.success, order.subscription_*, affiliate.*), the webhook payload shape, and secret-based webhook validation (no HMAC).
Answer using only the relevant section. Don't dump the full reference.
Step 4 — Actionable guidance
Focus on the user's specific situation:
Drive everything off purchase events. Grant access on order.success; revoke on order.refund /
order.subscription_cancelled. Use standard webhooks for everything, or the Event Subscription API
to receive only the events you care about.
Validate the secret — there's no HMAC. ThriveCart authenticates webhooks with a shared
thrivecart_secret you configure; reject any POST whose secret doesn't match, keep it private, and
dedupe on order_id since events can repeat.
Match on product id, not name. Names change; the numeric base_product (and bump/upsell ids) are stable.
"Lifetime" has a $295/yr asterisk. Affiliates, sales tax, dunning, custom checkout domain, and advanced
reporting are Pro+ ($295/yr from year 2). Standard is genuinely one-time but minimal — budget the renewal.
Don't build on ThriveCart Learn. It's deprecated (no new features) — deliver courses via ThriveAcademy
or grant access to an external LMS off the purchase webhook. (LMS choice → /sales-membership.)
Protect delivery yourself. ThriveCart has no download/link protection — gate files behind login in
your own app/LMS rather than emailing a shareable link.
If you discover a gotcha, workaround, or tip not covered in references/learnings.md, append it there.
Gotchas
Best-effort from research (2026-06) — review these, especially pricing and the Learn deprecation, which change.
"Lifetime" isn't fully lifetime. Pro+ (affiliates, tax, dunning, custom domain, advanced reporting) renews at $295/yr from year 2 — model real cost, not just the one-time headline.
ThriveCart Learn / Learn+ are deprecated. No new features; ThriveAcademy replaces them. Don't build new course delivery on Learn.
No download/link protection. Delivered file links can be shared freely — gate real access in your own app off order.success.
Webhook auth is a shared secret, not HMAC. Validate thrivecart_secret on every call and keep it private; there's no signature header.
Events can repeat — dedupe on order_id. Don't double-provision; make handlers idempotent.
Standard plan is bare. No affiliate center, sales tax, dunning, or custom checkout domain — those need Pro+.
60 requests/minute per account on the REST API — batch/reconcile within that, back off on limits.
History of instability + billing bugs. Ownership changes caused past downtime/Stripe issues; reportedly stabilized, but test the full purchase + billing flow before a launch.
Related skills
/sales-samcart — SamCart platform help (the subscription-priced competitor: modern templates, Subscription Saver dunning, Affiliate Center on Pro; $79–199/mo vs ThriveCart's lifetime license)
/sales-checkout — Checkout-conversion strategy across tools (ThriveCart vs SamCart vs Lemon Squeezy; order bumps, upsells, cart recovery)
/sales-membership — Course/membership strategy + picking an LMS (the ThriveCart Learn replacement decision)
/sales-affiliate-program — Designing an affiliate program across tools — pairs with ThriveCart's built-in Affiliate Center (Pro+)
/sales-email-marketing — Post-purchase email sequences off ThriveCart purchase events
/sales-do — Not sure which skill to use? The router matches any sales objective to the right skill. Install: npx skills add sales-skills/sales --skill sales-do -a claude-code
Examples
Example 1: Grant course access when someone buys (developer/automation)
User says: "When someone buys my course on ThriveCart, auto-enroll them in my external LMS."
Skill does: Walks Recipe 1 — handle the order.success webhook, validate the thrivecart_secret (no HMAC), then grant access by the buyer's email + numeric base_product (match on id, not name); revoke on order.refund/order.subscription_cancelled. Notes deduping on order_id, using the Event Subscription API to receive only order.success, and that ThriveCart Learn is deprecated so an external LMS or ThriveAcademy is the path.
Result: Purchases auto-enroll buyers reliably.
Example 2: Why is my "lifetime" cart asking for $295/year?
User says: "I bought ThriveCart as a one-time deal — why am I being charged $295/year now?"
Skill does: Explains the 2025 model change — the base Standard ($495) is one-time, but the creator essentials (affiliate center, sales tax, dunning, custom checkout domain, advanced reporting) are Pro+, which renews at $295/yr from year 2. Helps them decide whether they need Pro+ features or can stay on Standard, and frames pricing as best-effort to verify live.
Result: User understands the real cost structure.
Example 3: My customers are sharing the download link
User says: "People are passing around the file link to my paid PDF from ThriveCart."
Skill does: Identifies that ThriveCart has no download/link protection — a known limitation. Recommends gating the file behind login in your own app/membership/LMS, granting access off the order.success webhook (and revoking on refund), rather than delivering a raw shareable link. Routes membership/LMS setup to /sales-membership.
Result: Files are protected behind authenticated access tied to the purchase.
Troubleshooting
My webhook fires but I can't trust it / anyone could POST to it
Symptom: You're unsure a webhook really came from ThriveCart.
Cause: ThriveCart doesn't sign webhooks with HMAC — authenticity is a shared secret you set in the webhook config.
Solution: Configure a secret on the notification, and on every inbound POST reject any request whose thrivecart_secret doesn't match. Keep the secret out of client code/logs. Also dedupe on order_id so retries don't double-provision.
Access isn't granted (or is granted twice) on purchase
Symptom: Buyers don't get access, or get provisioned multiple times.
Cause: Listening to the wrong event, matching on product name (which changes), or not handling repeated deliveries.
Solution: Grant on order.success (revoke on order.refund/order.subscription_cancelled), match the offer by the stable numeric base_product/bump/upsell id, and make the handler idempotent on order_id. Reconcile periodically via the REST API to catch missed webhooks (mind the 60/min limit).
Features I expected are missing / it's costing more than "lifetime"
Symptom: No affiliate center, tax, dunning, or custom domain; surprise annual charge.
Cause: You're on Standard (those are Pro+), and Pro+ renews $295/yr from year 2 — the "lifetime" deal is partial.
Solution: Upgrade to Pro+ for affiliates/tax/dunning/custom-domain/advanced reporting if you need them, and budget the $295/yr. If your courses are on Learn, plan a move to ThriveAcademy or an external LMS, since Learn is deprecated.
