For this you would require an implementation of user authorisation (wikipedia).
This could be implemented in many different ways. You will need to look at your requirements and see what needs will be necessary to fulfil.
For example, you could create a simple database where you update a user's privileges after having received a legitimate purchase. Your SFTP-server could integrate with this database to retrieve information about the user's access rights. If the user is allowed to download the resource via the link, the SFTP server can return the downloadable resource, or otherwise reject the user's request.
Another option is to add a proxy, that handles the authorisation of the users, in front of the SFTP server so that the SFTP server is hidden on a local network and only accessible from the proxy. Then the proxy will be in charge of only granting access to legitimate customers.
You can make it as complex or simple as you'd like!