Run your shop on benchy.shop

Sellers and buyers

benchy.shop is the commerce spoke: digital products — 3D files and companion assets — sold by makers, with payouts through Stripe Connect and downloads gated by entitlements. Two hats exist:

• Sellers have shop access on their account and a Stripe Connect account. Selling is gated on Stripe's chargesEnabled — no onboarding, no listings.
• Buyers are any non-blocked Benchy member. Buying, holding a library, and downloading never require seller access.

Stripe Connect onboarding

Payouts run on Stripe Connect Express accounts with card payments and transfers. Onboarding is a three-step loop:

• Start onboarding from your shop dashboard (or via the shop_start_onboarding tool) — this creates the Express account and hands you a Stripe-hosted Account Link.
• Complete identity and payout details on Stripe's pages.
• Back on Benchy, the status refresh pulls chargesEnabled and payoutsEnabled from Stripe. Connect state is kept in sync by Stripe's account.updated webhook from then on.

Your embedded Stripe dashboard lives at benchy.shop/dashboard/stripe/connect, with a hosted Express dashboard link available whenever you need the full Stripe view.

Products

The catalog has a few hard, enforced invariants:

Creation is upload-first: request an upload, transfer the bytes, attach the file (which validates it and registers it for cleanup), then create the product against the returned file key. Bundles are products too — buying a bundle grants one entitlement per item.

Orders & entitlements

Purchases become access through webhooks — never through anything a client (or an agent) writes directly:

• A completed checkout inserts the order — gross, discount, fee, and the Stripe payment references — and grants an entitlement: the durable record that this account owns this product.
• Webhook replays are no-ops: orders are keyed by an external reference and every Stripe event is mirrored and deduplicated.
• Guest checkouts (email only, no account) get a 7-day, 10-use download token instead of an entitlement.
• Subscription entitlements follow the subscription: revoked on terminal states (canceled, unpaid, expired), kept through paused, past_due, and trialing — a billing pause is not an access revoke. A later permanent purchase overrides a subscription-gated entitlement.

Downloads

Files are delivered through a dedicated gateway at downloads.benchy.shop. When a buyer requests a download, Benchy checks the entitlement, rate-limits (60 an hour), and signs a short-lived claim — 10 minutes, HMAC-SHA256, bound to the exact file. The gateway worker verifies the signature and streams the bytes from the private bucket. It calls no database at all: the application stays the sole authority on who may download; the edge only checks math and moves bytes.

Treat minted URLs as secrets with a 10-minute fuse — mint on demand, never store them. The full gateway architecture is documented in the upload pipeline.

Refunds & subscriptions

• Buyers can request a refund within a 30-day window; requests are idempotent.
• Sellers see a refund queue and decide each case; full history stays visible to both sides.
• Subscribers self-serve card and plan changes through the Stripe billing portal; cancellation is at period end, propagated by webhook.
• Sellers get an operations view mirroring Stripe — orders, payouts (pending → in transit → paid), disputes, webhook events, and approximate MRR.

To hand all of this to an agent, use the Manage Your Benchy Shop skill — it encodes these flows plus the operating rules (dry-run first, confirm money actions, re-read Connect status).