For makers selling with Stripe Payment Links

Your paid page shouldn't open for anyone with the link.

Most static-site kits unlock with an unlisted URL. That URL gets forwarded, pasted and indexed, and every copy keeps working. Check how exposed yours is in two minutes, for free. Then tie access to a real Stripe purchase, on your own free Supabase.

Check my paid page Get the kit, $39

The checker runs entirely in your browser. Nothing you paste leaves this page.

How exposed is my paid page?

Three quick steps. Only the first is required, but each one makes the result sharper.

1The address buyers land on after paying

Copy it from your browser's address bar, or from your Stripe Payment Link's "after payment" setting.

2The page's source (optional)

Open your paid page, right-click and pick "View page source", then select all and paste it here. It's read, never run, and never sent anywhere.

3Eight quick questions

The pattern: a real lock on a static site

You don't need a backend, a login system or a monthly bill. You need one small function that asks Stripe a yes-or-no question before anything paid is shown. Here's the whole idea, free to use however you like.

  1. Buyer pays through your normal Stripe Payment Link. Nothing changes for them.
  2. Stripe sends them to /unlock/?session_id={CHECKOUT_SESSION_ID}. Stripe fills in the real checkout ID for you.
  3. Your unlock page sends that ID to a small edge function running on your own Supabase project.
  4. The function asks Stripe directly: is this checkout complete, paid, and for this product? Your secret key stays on the server, and a made-up ID gets a polite no.
  5. If yes, it records the purchase (email, checkout ID, a hashed personal token) and gives the buyer their own link. You can switch it off for refunds and disputes, and see when it's being opened from lots of places.
  6. Files live in a private storage bucket. Each visit gets fresh download links that expire in minutes, so there's no permanent URL to pass around.

What it fixes

The link stops being the product. Old shared links can be retired. Refunds lose access on their own. Lost links come back with an email and a receipt number, and nobody has to email you.

What it won't do

It can't stop a buyer from downloading a file and reposting it. Nothing on the web can. It just makes sure the easy, accidental kind of sharing doesn't hand out your product for free.

Why I built it

I sell small kits from static sites, each with a Stripe Payment Link and an unlisted page behind it. That setup is simple, but the link is the product: you can't tell how many people have it, you can't switch off access after a refund, and you can't change the URL without stranding real buyers.

Paid Page Lock is a do-it-yourself fix for that, written up step by step so you can run it on your own Stripe and Supabase accounts.

Iggy Mwangi

The kit

Paid Page Lock

$39 one time

Everything you need to swap your unlisted link for a real lock:

  • An edge function that asks Stripe "is this paid, and for this product?" before anything opens
  • A database schema with row level security, so your public key can't read a thing
  • A drop-in unlock page for any static site: personal links, restore by receipt, and an in-page reader
  • An optional refund webhook that switches access off automatically
  • A step-by-step setup guide, a test checklist, and a plan for moving past buyers over without stranding anyone
  • Owner SQL for spotting shared links and switching one off

Runs on your Stripe and your Supabase free plan. Nothing to pay me monthly, and your buyers' data never touches my servers.

Get Paid Page Lock: $39

Secure checkout by Stripe. You'll need a Stripe account using Payment Links, a free Supabase account, and a static site you can add one page to. Every setup step is written out, test mode first.

Questions

Can't buyers still share the files?

Yes. Anyone who has a file can share it, and no static-site setup changes that. What changes is that the link isn't the product anymore. Most leaks are accidental (a forwarded email, a link in a group chat), and those stop working.

Do I need to know how to code?

You'll copy files, paste SQL into Supabase's editor, and run a few commands in a terminal. Every step is written out. If you've deployed a static site before, you're fine.

Does it work on Netlify, Vercel or GitHub Pages?

Yes. The unlock page is a single HTML file, and the lock itself runs on Supabase, so any static host works. The guide includes Cloudflare Pages header files and notes for the others.

What about Supabase's free plan pausing?

Supabase pauses free projects after a week of low activity. The kit includes a free daily ping you can run on a Cloudflare Worker (or any scheduler you already use), plus how to check it's working. Supabase's paid plans never pause.

What happens to people who already bought?

The kit has a migration plan. You import past buyers from a Stripe export, send each one a personal link, and point the old URL at the new unlock page so nobody gets stranded.

I sell on Gumroad or Lemon Squeezy. Is this for me?

Probably not. Those platforms already host and gate your files. This is for people using Stripe Payment Links with their own site.

Can I use it on several products?

Yes. One Supabase project can lock as many products as you like. Each product is one row in a table.

Questions before you buy?

Contact Iggy at iggym.github.io.