Quickstart

Guiru does not host your product and does not want to know what people do inside it. The integration answers three questions and reports one fact: who is this, may they use it, did they actually use it.

Install the SDK and the parts that are easy to get wrong — webhook signatures, retries, PKCE — are already right. It is six endpoints underneath, so plain HTTP stays a first-class way to call them; see the SDK.

1. Get a key

Open your product's console, Integrate, and create a key. You will see it once — it is stored hashed and cannot be shown again. Start with a test key (gk_test_…): it reads real data but writes no usage evidence.

2. Ask whether somebody may use your product

curl -s "$GUIRU/api/v1/entitlements?user_id=$SHIN_USER_ID" \
  -H "Authorization: Bearer $GUIRU_API_KEY"

{
  "product_id": "8f14e45f-ceea-467a-9f1c-1a0b1a2b3c4d",
  "user_id": "3c1a…",
  "active": true,
  "type": "purchase",
  "source": "stripe:pi_3P…",
  "ends_at": null,
  "test_mode": false
}

3. Report that the session was real

curl -s -X POST "$GUIRU/api/v1/usage" \
  -H "Authorization: Bearer $GUIRU_API_KEY" \
  -H "content-type: application/json" \
  -d '{"user_id":"'"$SHIN_USER_ID"'","kind":"activity"}'

This is what earns from the Creator Pool and what a GSP seal is computed from. It is deduplicated per person per product per day, so calling it often is safe and pointless in equal measure.

4. Know when things change without polling

Register a webhook endpoint in the same console and you stop asking. A purchase, a refund, a cancelled subscription and an expiry all arrive as signed POSTs. See Webhooks.