DashCommerce for digital downloads

Why build a digital-download store?

The hosted options are genuinely good now. Gumroad, Lemon Squeezy, Paddle, Payhip — each one lets a solo creator take a PDF and have it selling globally in under an hour, with tax handled, CDN handled, receipt email handled. If you’re selling one ebook, one Notion template, one course, you should probably use one of them. This page isn’t trying to argue otherwise.

The tradeoff is control. Hosted storefronts own the checkout URL, the customer relationship, the email sending identity, and the design surface. They take a platform fee that grows with your revenue. They decide what file sizes are allowed, what the receipt looks like, which analytics you can see. If you’re running a team, selling into a catalog that includes docs and community and SaaS, or building a brand where the checkout has to look and feel like the rest of the site — that control matters more than the time saved.

DashCommerce is the version of digital-downloads commerce that assumes you want to own the surface. It runs inside your own Astro project, ships no hosted layer, and takes zero fee per sale. You pay Stripe and nothing else. In exchange, you run the infrastructure and handle your own tax.

How DashCommerce handles digital-downloads

DashCommerce ships six product types: simple, variable, grouped, external, digital-download, and subscription. The digital-download type is purpose-built for non-physical goods.

Each digital-download product carries a file reference — a pointer into EmDash’s storage layer. EmDash’s storage layer is abstracted: locally, it writes to disk; in production, it can be configured for any S3-compatible object store or Cloudflare R2. DashCommerce never touches the file directly. It only asks EmDash for a signed URL when a buyer claims their download, and trusts the storage layer to return something time-limited and non-guessable.

At checkout, the buyer pays via Stripe Payment Intents — same checkout element used for physical goods, subscriptions, and marketplace orders. On successful payment, the order moves to completed status and the download links become active. The receipt email, powered by DashCommerce’s transactional email module, goes out immediately with clickable download URLs. The same links appear in the buyer’s order history.

Multi-currency works per product — you can set a USD price and a EUR price and a JPY price, and buyers see the one that matches their region. Coupons work the same as for physical products: percentage off, fixed amount off, scoped to specific products or the whole cart. Abandoned-cart recovery fires emails when a buyer adds a digital product to the cart and doesn’t check out — same mechanism, same templates.

Nothing about digital-download is bolted on. It’s the same order model, the same admin pages, the same webhook payloads — just with a file reference instead of a shipping calculation.

The signed-token download mechanism

The security question on every digital-download store is: how do you prevent the download URL from being shared?

The honest answer: you can’t fully prevent it. Someone who buys your ebook can always screen-record themselves opening the PDF and upload it to a pirate site. Digital goods are copyable.

What you can do is prevent trivial link-sharing, which is the practical threat. DashCommerce handles this with three layers:

1. The underlying file lives in private storage. EmDash’s storage layer, whether local disk, S3, or R2, is configured so objects are not publicly readable. No guessable path resolves to a file.
2. Signed URLs, time-limited. When a buyer clicks a download link, DashCommerce asks the storage layer to mint a signed URL valid for a short window — typically 24 hours. After expiry, the URL 404s. If someone posts their signed URL to a forum, it stops working by tomorrow.
3. Token rotation. The underlying download entitlement is a token tied to the order. Every time the buyer visits their order page, a fresh signed URL is generated from the token. The token itself is private to the order and not exposed in the URL.

There’s no HLS streaming, no DRM wrapper, no device fingerprinting. If you need those, you’re building something DashCommerce doesn’t ship. But for the realistic threat model of digital creators — stopping casual re-sharing of download links — the signed-token pattern is what every serious digital-download platform uses, and it works.

Three shapes that fit

Creator assets. Notion templates, Figma kits, video LUTs, icon packs, font files, stock photography bundles. Each sale is a one-time purchase, usually $10 to $200. The typical creator has a catalog of 5 to 50 products and a content funnel (blog, Twitter, YouTube) driving traffic to them. DashCommerce handles the catalog and checkout; your Astro site handles the content marketing. Because both live in the same repo, there’s no cross-domain bounce, no subdomain that looks different, no Shopify-themed storefront inside your otherwise-bespoke site.

Ebooks and courses. PDFs, EPUBs, MP4 video bundles, workbooks. Sometimes one-time, sometimes subscription (access to a growing library). The digital-download type handles one-off sales; subscriptions pair naturally for drip-release or membership content. Email deliverability matters more here — buyers expect receipts to arrive in their inbox, not spam. DashCommerce’s transactional email module includes receipt and renewal templates that you can point at Resend, Postmark, or any SMTP relay.

Developer tools. Paid plugins, themes, VSCode extensions, CLI binaries, SDK licenses. The usual pattern: sell the product via DashCommerce, issue a license key via your own server on order-complete webhook, deliver the key via the receipt email and order history. For products with per-seat or per-domain licensing, DashCommerce hands you the primitives (the order, the customer, the signed token) — you build the activation check against your own license server.

The tax reality for digital sales

This section exists because too many marketing pages pretend tax is a solved problem.

If you sell digital goods internationally, you owe tax in jurisdictions with digital-goods VAT rules — the EU (all 27 member states), the UK, Norway, South Africa, Australia, New Zealand, and a growing list of others. The legal question is: who is the seller of record?

With DashCommerce, you are. You registered for VAT, you charge it, you file it. Stripe Tax, which integrates into DashCommerce’s checkout, calculates the correct rate based on buyer location and your tax settings — that’s the computational part. What Stripe Tax does not do is file your VAT returns for you. Stripe Tax produces remittance-ready reports; you or your accountant submits them.

With Lemon Squeezy or Paddle, they are the seller of record. They handle registration, filing, and remittance globally. You pay a higher effective fee (typically 5% + $0.50 per transaction on Lemon Squeezy versus Stripe’s 2.9% + $0.30) and in exchange you never see a VAT form.

For a solo creator doing $2,000/month in global digital sales, Lemon Squeezy’s MoR model is almost always cheaper than the cost of an accountant to handle VAT. For a team doing $100K/month with an existing finance function, DashCommerce plus Stripe Tax plus your accountant is cheaper by a wide margin.

This is a real tradeoff. Make it with open eyes.

Subscriptions for digital bundles

The subscription product type in DashCommerce runs on Stripe Subscriptions — trials, proration, upgrades, cancellation flows, dunning emails. For digital goods, subscriptions unlock a few common patterns:

• Membership libraries. A monthly fee gives access to a growing library of ebooks, courses, or templates. DashCommerce can gate a digital-download product behind an active subscription — no active sub, no signed token issued.
• Drip-release courses. Weekly lesson unlocks while the subscription is active.
• Tool subscriptions. A plugin or SaaS tool sold as monthly/annual — renewal continues license validity.

Access logic is the pattern: on every download request, DashCommerce checks whether the gating subscription is active. Cancel the sub, the downloads stop on the next period boundary (or immediately, configurable). This is one of the places where running commerce inside your own code pays off — you can write exactly the access rule that matches your business instead of picking from a hosted platform’s three presets.

License key delivery

DashCommerce does not ship a license server. What it ships is the wiring to plug one in cleanly.

The pattern:

1. Buyer completes purchase; DashCommerce fires an order.completed webhook containing the order ID, buyer email, and product IDs.
2. Your license server receives the webhook, mints a license key (UUID, signed JWT, whatever format fits your product), and stores it indexed by order.
3. Your license server calls back into DashCommerce to attach the license key to the order as metadata.
4. The receipt email and order history page render the key alongside the download link.

For activation checks, your software calls your license server (not DashCommerce) to validate the key. Per-seat limits, domain restrictions, expiry windows, and revocation all live on your server.

This is a deliberately simpler architecture than what hosted platforms sometimes offer bundled. You own the license logic, which means you can evolve it — floating licenses, team accounts, offline activation — without negotiating with a vendor. You also own the obligation to build and maintain it, which is real work. If you want plug-and-play license management and are willing to pay for it, look at Paddle or Lemon Squeezy, which bundle basic license servers in their plans.

When DashCommerce isn’t the right tool

Be honest about this. DashCommerce isn’t for everyone selling digital products.

• Solo creators under ~$10K/month. The time savings from a hosted platform are worth more than the platform fee at this scale. Use Gumroad or Lemon Squeezy and get back to making things. The moment you’re doing a team standup about your e-commerce stack, you’ve already lost the money the hosted platform would have cost you.
• You want MoR for global tax. DashCommerce is not an MoR. Lemon Squeezy and Paddle are. If not filing VAT returns is worth 2–3% of revenue, stop reading and go sign up with one of them.
• You need a zero-config storefront. DashCommerce requires an Astro project running in production — your responsibility to deploy, monitor, and scale. Gumroad gives you a hosted storefront in five minutes. If you don’t have a deploy pipeline and don’t want one, DashCommerce will fight you.
• Your catalog is one product and will stay that way. The overhead of a full commerce stack is real. For a single product, a hosted platform or even a bare Stripe Payment Link is a cleaner answer.

When DashCommerce is the right tool

• You run a team. Engineers on staff, a design system, a Git workflow. You want commerce to plug into that, not a second vendor admin to context-switch into.
• You need custom checkout or storefront design. Hosted platforms constrain what the checkout can look like. DashCommerce’s checkout is React inside your Astro project — bend it however far your design system requires.
• You sell digital alongside content. Docs, blog, courses, community forum, SaaS dashboard — and now also a paid download. Keeping all of that in one repo with one auth system and one deployment surface is the thing DashCommerce exists to enable.
• You want source control. MIT license, on GitHub, forkable. No vendor can shut you down, change terms on you, or decide your niche doesn’t fit their product roadmap anymore.
• Zero platform fee matters. Stripe’s fee is the only fee. At volume, this is the difference between profitable and not.

If all five apply, DashCommerce is shaped for you. If none apply, use something else — the point is not to push DashCommerce into places it doesn’t fit. The point is to be clear about where it does.