Run your shop on benchy.shop

Sellers and buyers

Create a product and complete Stripe Connect KYC in Studio at benchy.studio/dashboard/shop. Checkout, payouts, and the public Buy page stay on benchy.shop. A World listing can link to that product — World does not set a price. There are two roles:

• Sellers have shop access on their account and a Stripe Connect account. You can save drafts straight away; listing a product needs Stripe to report chargesEnabled and payoutsEnabled, in the same live-or-test mode your shop is running in.
• Buyers are every Benchy member. Buying, holding a library, and downloading never require seller access.

Stripe Connect onboarding

Payouts run on Stripe Connect Express accounts with card payments and transfers. Onboarding is a three-step loop:

• Start onboarding from Studio at benchy.studio/dashboard/shop (or via the shop_start_onboarding tool) — this creates the Express account and hands you a Stripe-hosted Account Link.
• Complete identity and payout details on Stripe's pages.
• Back on Benchy, the status refresh pulls chargesEnabled and payoutsEnabled from Stripe. Connect state is kept in sync by Stripe's account.updated webhook from then on.

Payouts and Connect status live with your account at benchy.studio/dashboard/shop, with a hosted Express dashboard link for the full Stripe view. Day-to-day seller operations stay at benchy.shop/dashboard/stripe/operations.

Products

The catalog enforces these rules on every write:

Creation is upload-first: request an upload, transfer the bytes, attach the file (which validates it and registers it for cleanup), then create the product against the returned file key.

Orders & entitlements

Purchases become access through webhooks — never through anything a client (or an agent) writes directly:

• A completed checkout inserts the order — gross, discount, fee, and the Stripe payment references — and grants an entitlement: the durable record that this account owns this product.
• Webhook replays are no-ops: orders are keyed by an external reference and every Stripe event is mirrored and deduplicated.
• Guest checkouts (email only, no account) get a 7-day, 10-use download token instead of an entitlement.
• Subscription entitlements follow the subscription: revoked on the terminal states canceled, unpaid, and incomplete_expired, kept through paused, past_due, and trialing — a billing pause is not an access revoke. A later outright purchase upgrades a subscription-gated entitlement to a permanent one, and a permanent entitlement is never downgraded.

Downloads

Files are delivered through a dedicated gateway at downloads.benchy.shop. When a buyer requests a download, Benchy checks the entitlement, rate-limits (60 an hour), and signs a short-lived claim — 10 minutes, HMAC-SHA256, bound to the exact file. The gateway worker verifies the signature and streams the bytes from the private bucket. It calls no database at all: the application stays the sole authority on who may download; the edge only checks math and moves bytes.

Treat minted URLs as secrets with a 10-minute fuse — mint on demand, never store them. The full gateway architecture is documented in the upload pipeline.

Refunds & subscriptions

• Buyers can request a refund within 30 days of paying, up to three requests per order. Re-requesting while one is open returns the open request rather than opening a second.
• Sellers work a queue of open requests and decide each case. Buyers keep their full request history, and sellers keep theirs on the seller dashboard.
• Subscribers self-serve card and plan changes through the Stripe billing portal; cancellation is at period end, propagated by webhook.
• Sellers get an operations view mirroring Stripe — orders, payouts (pending → in transit → paid), disputes, webhook events, and approximate MRR.

To hand all of this to an agent, use the Manage Your Benchy Shop skill — it encodes these flows plus the operating rules (dry-run first, confirm money actions, re-read Connect status).