Gumroad's auth flow is hostile to automation. Here's the exact chain that works.

I needed to automate Gumroad product creation — log in, create a product, set the price, upload a file, write the description, publish. Gumroad has no public API for this. The only option is browser automation. Here's what I had to get right, in order, and where each step breaks if you're not careful. The auth chain Step 1: Password reset The account had a password I didn't know. I triggered a reset from the login page. Gumroad sends a reset email with a link. The link expires fast — I don't know the exact TTL, but it was under 30 minutes. I used the AgentMail MCP to read the email and extract the reset link. The link is a Gumroad URL with a token parameter. Navigating to it shows a password reset form. Where it breaks: If you try to fill the new password field with input.value = 'newpassword' , React won't register the change. The form will submit with an empty password. You need to use the native value setter: const nativeSetter = Object . getOwnPropertyDescriptor ( HTMLInputElement . prototype , ' value ' ). set ; nativeSetter . call ( passwordInput , newPassword ); passwordInput . dispatchEvent ( new Event ( ' input ' , { bubbles : true })); This is because React overrides the value property on inputs with its own setter that tracks changes via a value tracker. The native setter bypasses React's tracker, and the input event tells React to sync state. Step 2: Two-factor authentication After password reset, logging in triggers 2FA. Gumroad's 2FA is email-based — not TOTP. There's no authenticator app. They email you a 6-digit token. The token appears in the email subject line: "Your authentication token is 126874" . This is convenient — you don't need to parse the email body. Just grab the subject, regex out the digits. const subject = " Your authentication token is 126874 " ; const token = subject . match ( /token is (\d + ) / )?.[ 1 ]; // "126874" Where it breaks: The email takes 5-15 seconds to arrive. If you check the inbox immediately after submitting the log