Lemon Squeezy

Sell digital products and subscriptions with Lemon Squeezy — API docs: https://docs.lemonsqueezy.com/api

Connection: an API key from app.lemonsqueezy.com → Settings → API → +. The key is shown once. It spans every store on the account, which is why store-scoped steps take a Store dropdown rather than the connection carrying one.

Base URL: https://api.lemonsqueezy.com/v1, authenticated with Authorization: Bearer <key>.

Actions

List Stores, List Products, List Orders, Get Order, List Customers, List Subscriptions, Get Subscription, Cancel Subscription, Create Checkout.

Create Checkout is the one most flows want: pick a store and variant, optionally prefill the buyer's name and email, apply a discount code, set an expiry, and attach Custom Data key/value pairs that come back on the order and on every webhook — that's how you tie a checkout to a record in your own system.

Cancel Subscription is a DELETE, but not a hard delete: the subscription moves to cancelled and keeps serving until ends_at.

Triggers

New Order, New Subscription, Subscription Cancelled, Subscription Payment Failed.

These are real webhooks, not polling. Lemon Squeezy exposes POST /webhooks and DELETE /webhooks/{id}, so enabling a trigger registers a webhook scoped to the chosen store and disabling it deletes the registration — no orphaned subscriptions accumulate on the account.

Deliveries are signature-verified. The webhook URL is otherwise the only thing between the internet and someone starting your billing flow with a forged "order paid" event. Each registration generates its own secret; every delivery's X-Signature is checked as an HMAC-SHA256 of the raw body against it, using a constant-time compare, and anything that doesn't verify is dropped without firing the flow.

Trigger output includes the top-level event_name and custom_data from the delivery, not just the resource — custom_data is where the correlation keys you attached in Create Checkout come back, and they live outside data.attributes.

Notes on the API

Lemon Squeezy is a JSON:API implementation, which affects what you see in step output:

• Requests must send Accept: application/vnd.api+json; a plain application/json Accept is rejected.
• Resources come back as { type, id, attributes } with id outside attributes. This piece flattens them to { id, type, ...attributes } so a step's output carries the id the next step needs. Returning attributes alone would look complete and be unusable.
• List actions return { items, page }, keeping Lemon Squeezy's pagination metadata so a flow can page through large result sets.