Shopify /buy permalinks are the new link format for sending a shopper straight into a filled cart or checkout, and they replace /cart permalinks as the place where new features land. Announced on October 28, 2026 alongside Editions Fall 2026, the /buy route implements the Universal Commerce Protocol permalink capability, so the same link shape works on any store that supports UCP. Old /cart links keep working. The question for a merchant is which links to move, which to leave alone, and what breaks if you migrate blindly.
What changed on October 28
Every Shopify storefront now exposes a /buy route that builds a cart from the URL and sends the buyer to checkout. Per the Shopify changelog, stores advertise the capability dev.ucp.shopping.permalink in their discovery profile at /.well-known/ucp, starting with UCP version 2026-08-25. Items sit in the path as variant ID and quantity pairs separated by commas. Everything else is a query parameter named after its field path in the UCP schema: buyer/email, context/address_country, discounts/codes/0, and so on.
Shopify calls /cart the legacy format. It stays supported, but new capabilities only ship on /buy. That is the real news. Shopify is not deprecating a URL, it is moving its roadmap to an open spec that agents, affiliate tools and email platforms can target without knowing anything Shopify specific.
/buy vs /cart permalinks: what each one can do today
/buy wins on prefill, attribution and portability, while /cart still wins on anything that touches subscriptions or custom cart data. According to the permalink documentation, a /buy link can carry up to 500 items within a 2,048 byte URL, prefill email and an E.164 phone number, set country and language, prefill a shipping address, apply discount codes, ask for Shop Pay, and land the buyer on any same origin path through continue_to instead of checkout.
Attribution is the part that looks better on paper than it behaves in practice. /buy accepts the five UTM fields, a referring domain, one click ID pair such as a Google click ID, and one activity ID pair. All of them need the attribution/ prefix. A plain utm_source or gclid on a /buy link is silently ignored. Any link builder or ESP template that appends UTMs automatically will produce links that convert and then vanish from your channel reports.
What /buy cannot do yet matters just as much. It has no selling plans, no line item properties, no cart notes, no cart attributes, no ref referral code and no sales channel attribution through a storefront access token or source_name. Products sold only as subscriptions cannot produce a cart at all. If your bundles depend on line item properties, or your gift flows write a note to the cart, those links stay on /cart for now.
Two behaviours differ in ways shoppers notice. Opening a /buy link creates a fresh cart holding only the link's items, replacing whatever the buyer had. And if one item fails for any reason other than stock, no cart is created at all, even for the valid lines. Out of stock lines are trimmed to what is available or dropped.
Why the open spec matters more than the URL
The point of /buy is that an AI agent can build a working checkout link for a store it has never seen, using only the store's public UCP profile. The UCP permalink specification requires a 303 redirect, a no-store cache header and a referrer policy, forbids permanent redirects, and recommends URL budgets of 512 bytes for QR codes and print, 1,024 for SMS and broad campaigns, and 2,048 for email. Those are rules a shopping assistant can rely on without a Shopify integration.
This continues a pattern we have tracked all year. Shopify keeps adding agent entry points, from the catalog side we compared in Shop MCP vs Storefront Catalog MCP to the checkout side. /buy is the cheapest of them for a merchant, because there is nothing to configure. Shopify hosts the endpoint and lists it in the profile. Headless stores are covered too: Hydrogen 2026.10 forwards /buy links to the store, as we noted in our Hydrogen 2026.10 upgrade review. A custom React or Next.js storefront on its own domain needs to route /buy itself or link to the Shopify domain.
What we would change this quarter
Start by moving the links you build yourself and leave the links that depend on custom cart data on /cart. In practice that means three passes.
First, inventory. Search email templates, SMS flows, paid social ads, influencer kits, QR codes on packaging and any internal tools that generate /cart links. Tag each one by whether it uses line item properties, notes, attributes, selling plans or a channel access token. Those stay put.
Second, migrate the simple ones with attribution rewritten. Every UTM gets the attribution/ prefix, every value is percent encoded, and the link is tested on a real device before it ships. Watch the holiday calendar: a reworked abandoned cart or win back flow is a reasonable November change, a rebuilt Black Friday campaign is not. Pin the protocol version with ucp/version=2026-08-25 in links that will live for months, such as printed QR codes, so a future default does not change their behaviour.
Third, separate personal links from public ones. Shopify is direct about this: a link with buyer/email or an address belongs to one buyer and should never go in a QR code, a public post or a broadcast campaign. The spec gives the reason. URLs leak through browser history, logs, analytics tools and screenshots. Prefilled email links are fine in one to one transactional sends. Everywhere else, keep links to items, quantities, country, discount and campaign fields.
For merchants running Shopify Plus storefronts, the bigger move is making the catalog legible to agents that will generate these links on their own. Clean variant data, stable IDs and products that can be bought without hidden cart attributes are what let an assistant send a working /buy link. When we design AI native shopping flows, that data hygiene does more for conversion than any single link format.
Is it worth migrating now?
Yes for new links, and selectively for existing ones. New features only ship on /buy, the format is portable across UCP stores, and prefill plus Shop Pay preference shortens checkout on mobile. The risks are concrete and manageable: lost attribution from unprefixed UTMs, replaced carts for returning shoppers, and missing support for subscriptions and line item properties. Test those three, and /buy is the better default from here on.