Build with Guiru

Your app.
Connected.

Give customers access to your product, connect their purchases and keep up with subscription changes.

SERVER / @guiru/sdk

import { Guiru } from "@guiru/sdk";

const guiru = new Guiru({
  apiKey: process.env.GUIRU_API_KEY!
});

const active = await guiru.entitlements
  .isActive({ userId });

The whole surface

Sign in with Shin IDOAuth 2.0 with PKCE. Connect a Guiru account to your app.

EntitlementsOne server-to-server call: may this person use my product, and why. Purchase, subscription and Member all answer in the same shape.

Usage evidenceThree generic signals. Report qualified activity for Member participation and product success signals.

WebhooksSix events, signed, retried with backoff. React to purchases, refunds and access changes.

npm install @guiru/sdk and the parts that are easy to get wrong — webhook signatures, retries, PKCE, telling consent-withdrawn from a bad request — are already right. Six endpoints underneath, so plain HTTP stays a first-class way to call them from any language.

Read the docs The SDK llms.txt, for agents

Documentation

Start with a working integration, then explore the API by task.

QuickstartFrom an API key to a verified entitlement in four calls.SDKOne package for identity, entitlements, usage and webhook verification. No dependencies.AuthenticationTwo credentials: a product API key for server-to-server, an OAuth token for acting as a person.Sign in with Shin IDOAuth 2.0 authorization code with PKCE, two scopes, and a consent screen that names exactly what you receive.EntitlementsOne call that answers whether this person may use your product, and why.Usage & Qualified Active DaysThree generic signals. No feature events, no payloads about what happened inside.Purchases & refundsWhat Buy with Guiru does on your behalf, and the two events you actually handle.WebhooksSix events, one envelope, at-least-once delivery with exponential backoff.Verifying signaturesHMAC-SHA256 over timestamp and raw body, compared in constant time, inside a five-minute window.Importing a productPaste a URL; Guiru reads what is already public and you confirm what becomes the listing.GitHub importWhat a repository gives the listing, what it does not, and how a repository stays connected.Selling without the SDKBuy with Guiru works before any integration exists. What each delivery method needs from you.Currencies and pricingPrice in USD, BRL, EUR or GBP; add explicit prices in other currencies; nothing is ever converted for you.Buy with Guiru from your own siteOne link. The price, the checkout, the receipt and the entitlement are Guiru's; the click starts on your page.Integration diagnosticsWhat the console can tell you about your integration, and what you can fix from it without asking anyone.Errors & rate limitsWhat each status means, and the budgets that produce a 429.TestingTest keys read real data, write no evidence, and let you force either answer.Mobile APIThe first-party surface the Guiru app talks to. Documented so it is not a mystery, not so you build on it.ReferenceEvery public endpoint, its credential and its shape, on one page.Versioning & changesOne version, additive changes, and what counts as breaking.For agentsAn MCP server and a plain-text build, so the agent writing the integration reads the current docs.

Built for agents too

The same docs, as one plain-text file.

Most integrations are now written by a person and an agent together, and the agent is usually reading a copy of an API reference pasted into a prompt. So the whole documentation is served at /developers/docs/llms.txt, generated from the same source these pages render — the page and the text cannot disagree. What to tell your agent →

Limits and terms

Rate limits answer 429 with retry-after. Credentials are shown once and stored hashed. Errors and budgets → · Developer terms →

Wire it once. It answers for every product you ever list.

Submit a product Browse the docs