A Stripe Payment Link takes the money, but the file is your job. Stripe's two after-payment options, three ways to hand over a guide or template without a backend, which of them can be forwarded (all of them), and when a platform like Gumroad, Lemon Squeezy or Payhip is the better tool.
The first sale comes in. $19 for the guide you spent a month on, paid through a Stripe Payment Link you set up in ten minutes. Then an email: thanks, I paid, where's the guide?
They're right to ask. They have a Stripe receipt that says what they paid. A receipt covers the payment (you can brand it), but it isn't a place to attach a guide, and nothing told Stripe there was one.
If you're still deciding how to take the money, taking payments on a static page with no backend covers that part, including the line this post works inside: access that unlocks only after a payment is checked needs a server. This post is about the step after the money, when you don't have one.
Stripe's post-payment documentation describes two choices, set under the Payment Link's After the payment setting:
{CHECKOUT_SESSION_ID} to that URL, for instance as ?session_id={CHECKOUT_SESSION_ID} on the end, and Stripe swaps it for the ID of that buyer's checkout session.The session ID is useful if something can look it up. A server holding your Stripe secret key can ask Stripe whether that session was paid and only then show the file. A static page can't do that check, because doing it means putting the secret key where anyone can read it. So without a backend, the ID in the address is decoration. The redirect URL itself is what lets people in.
Three setups work without a server of your own. They differ in where the buyer finds the file later, and in what you have to set up.
| How the buyer gets it | Where they find it six months later | Can it be forwarded? | What you need |
|---|---|---|---|
| Link and password in the confirmation message | Only if they saved it. The confirmation page is something they see right after paying, not something they come back to | Yes, both | Nothing beyond the Payment Link |
| Redirect to a delivery page | Only if they bookmarked it | Yes, the URL is the key | A page at an address nobody can guess |
| An email sent after the sale (a tool like Zapier, or a webhook) | In their inbox, next to the receipt | Yes, emails forward | An automation account, or a small server listening for Stripe's "payment completed" event |
Two things follow from that table.
Whichever you choose, also email it. People close tabs. The one thing every buyer keeps is the email thread, and six months from now that's where they'll look. For the first few sales, a short email you send by hand is fine. Once that gets tedious, an automation that watches Stripe for a completed checkout and sends the buyer a fixed email is the step up. A webhook is Stripe calling a URL when the payment goes through; the page on taking payments without a backend explains why something has to be listening on the other end.
The redirect doesn't make the file safer. It feels more official than a link in a message, but the delivery page's address shows in the buyer's browser and can be copied like any link. The only thing it adds over the confirmation message is that the buyer doesn't have to click once more.
On a host that gives you a link nobody can guess, lets you put a password on it, and lets you replace the file behind it later. On miinideck, that looks like this:
Don't use the no-signup upload page for a product. Those links last 7 days and the file can't be replaced, which suits a quick share and not something people pay for.
Upload the guide, add a password, and paste the link into your Payment Link's confirmation message. Your one permanent link is included free.
It has to. Someone who bought a template in spring will open it again in autumn, on a new laptop, from the email you sent. If the link has expired by then, you've sold them a dead link and they'll tell you so, or worse, they won't.
That rules out anything that lapses after a week. Here is how it works on miinideck's plans:
Yes. Every option above hands the buyer something they can pass on: a link and a password in a message, a URL in the address bar, or an email they can forward. A password keeps the file away from strangers. It doesn't keep it away from a buyer's friend.
Changing the password doesn't fix that either. Anyone opening the link afterwards needs the new password, and that includes the people who paid. A browser that already got in with the old one can keep viewing for up to about 4 hours. So a new password means emailing every past buyer, and anyone who wants to share it will share the new one too.
For most $9–$49 guides that trade is fine. The people who forward a guide were rarely going to buy it, and you keep the whole sale apart from Stripe's fee. If it isn't fine, if each copy has to belong to one buyer, use a tool built for that. Gumroad, Lemon Squeezy and Payhip all handle delivery for you: each buyer gets their own download after paying, and you get a record of who bought what. They charge for this, either a cut of each sale or a monthly plan, and that is what pays for the per-buyer part. If you sell software that needs a license key, or you're about to spend your evenings policing shared links, the cut is cheap.
Replace the file behind the same link. In your miinideck dashboard, open the page and choose Replace file. The link and the password stay as they were, so everyone who opens the link from then on gets the new version. Nobody needs a new email to find it, and buyers who never come back aren't bothered.
A few things to know:
There's more on swapping a file without breaking the link, including what Google Drive and Dropbox do, in updating a PDF without changing the link. If you're comparing where a password-protected page can live at all, whose free plan includes a password goes through the main hosts.
An annual report gets read in March by donors on their phones, printed for the board, and reopened in September by a funder. How a PDF attachment, a page on your website and a single replaceable link each hold up over that year, and how to fix a typo after it's out.
We ran one sponsorship-packet prompt in Claude and checked the result on a phone. Here is the prompt, a table of what the AI used, made up or left blank on the page, and the one-word edit that marks a tier SOLD OUT.
An attachment can't be updated. A link can, if the host lets you replace the file behind it. What Google Drive's Manage versions does, what Drive, Dropbox, OneDrive and Acrobat don't say about the link, when you shouldn't swap a file quietly, and what the reader sees after you do.
miinideck turns a single HTML file into an unguessable link with optional password and expiry. Default-private, never indexed.