If you searched Shopify cart permalink, checkout link, /cart/variant_id:1, or you pasted the URL Community threads keep quoting — https://your-store.com/cart/123:1 — you are looking at one Shopify route.
That address is a cart permalink. In the admin, the same link is Create checkout link. Shopify reads a variant id and a quantity out of the path, puts them in a cart, and sends the browser to checkout. The product page, the cart page, and your theme never have to load. A campaign email, the Buy Button, and an abandoned-checkout script can all use that path. The query string is what changes checkout, the cart page, a discount, or Shop Pay.
What does /cart/123:1 mean?
https://{shop}/cart/{variant_id}:{quantity}Four pieces:
{shop}—your-store.comoryour-store.myshopify.com. The link works on both. A storefront password still applies. Selling plans do not work on this URL./cart/— Shopify’s cart route. This is the part that skips the product page.{variant_id}— the numeric id of one purchasable version of a product (a size, a color).123in the threads is a stand-in. A live id is longer, like36485954240671.:{quantity}— how many.:1is one unit.
The long Community thread about bots abandoning checkout every day writes it as https://your-store.com/cart/:1 and tells you to drop a variant id in front of the colon. Other replies write /cart/variant:1 or /cart/PRODUCTID:1. The number Shopify reads is the variant id. The product id in the admin URL (/products/1234567890) is a different number. A permalink built with the product id does not add that product.
To copy a real variant id: open the product, open the variant, and take the number after /variants/ in the address bar. Or, with the Buy Button channel installed, open the product and choose More actions → Create checkout link, pick the variant, and copy. The link Shopify gives you is this permalink plus ?channel=buy_button.
More than one variant is a comma, no spaces:
https://your-store.com/cart/36485954240671:3,31384149360662:1A locale can sit in front of /cart/ so checkout opens in that language: https://your-store.com/fr/cart/36485954240671:1.
Each person who opens the link gets their own cart. It is a recipe for a cart, not a shared cart and not a saved checkout.
Checkout is the default
Open https://your-store.com/cart/36485954240671:1 and Shopify puts that variant in the cart at that quantity, then continues into checkout. The shopper does not stop on the homepage, a collection, or the product page.
The cart page is a query flag. Add ?storefront=true and the same path lands on the online-store cart, where the shopper can change the cart before checkout:
https://your-store.com/cart/36485954240671:1?storefront=trueNo query means checkout. storefront=true means the cart page.
The query string is the difference
The path picks the variant. The query string picks what happens next, and who the link was for.
| Query | Example | What it is for |
|---|---|---|
| (none) | /cart/36485954240671:1 | The URL threads quote. Checkout, one variant. |
storefront=true | …:1?storefront=true | Stop on the cart page. |
payment=shop_pay | …:1?payment=shop_pay | Open a Shop Pay checkout. |
channel=buy_button | …:1?channel=buy_button | The Buy Button “Create checkout link.” |
discount=CODE | …:1?discount=15off | Apply a discount code. Several codes are comma-separated. |
note, attributes, ref | …:1?ref=newsletter | A note, cart attributes, or a referral code on the order. |
utm_, gclid, and similar | …:1?utm_source=klaviyo | An email or ad click. |
Shopify’s developer docs also allow checkout[email] and checkout[shipping_address][…] on the same URL, so a sales channel can pre-fill contact fields. A Buy Button, an email, and the link in the thread can share the /cart/{id}:{qty} path. The extra parameters are how a campaign sets a discount, a channel, or tracking.
The bare link threads quote
The post that gets pasted is the path with nothing after it:
https://your-store.com/cart/VARIANT_ID:1One request adds the variant and opens checkout. Your theme does not render, so a captcha in the theme, a country overlay, and an app embed on the product page have no page to run on. Shopify built the route so a campaign can skip the storefront on purpose. A script can call the same route. The thread is right about that part.
Orders → Abandoned checkouts does not show the URL that created the row. The row shows a name, an email, and a cart.
Permalinks that are a different URL
A few addresses get lumped in with /cart/123:1. They are different routes.
/cart/add.js is the Ajax endpoint themes POST to when someone clicks Add to cart. The variant id is in the body, not the path. It shows up in the same threads as another way to reach checkout without loading the product page. It is not a permalink.
/cart/add (no .js) is the HTML form action many themes use for a normal add-to-cart.
/cart/c/… is a Shop Pay cart link, a token after /cart/c/. A real Shop Pay checkout looks like that. It does not look like variant:1.
/cart/clear, /cart/update.js, and /cart/change are cart maintenance. Themes and apps hit them while a shopper edits a cart.
An abandoned-checkout recovery link is also different. Shopify’s recovery URL looks like /checkouts/…/recover?key=…. That key reopens one checkout that already exists. A cart permalink builds a new cart from variant ids. Klaviyo threads sometimes swap the two when a recovery click opens the Shop app; replacing the recovery URL with a permalink is a different job from the bare :1 link in the bot threads.
Why a theme app never sees it
Theme code runs on pages your theme renders. A permalink request is handled by Shopify’s cart route, then checkout, which apps do not get to wrap. So:
- Storefront hCaptcha still covers contact forms, comments, and login. It has no checkout row, and this URL never posts one of those forms.
- An IP or country app that injects into the theme never loads for this request. The same permalink on
*.myshopify.comalso misses a firewall that only sits on your custom domain. That gap is the one in Cloudflare in front of Shopify. - Shopify’s Human or bot session filter labels storefront sessions. A checkout created by a permalink often has no storefront session to label. The abandoned checkout still exists.
Requiring a customer account before checkout puts the login form in front of this route. That raises friction for a crude script and for a guest who came from an email. Guest checkout exists because that guest converts.
You cannot turn cart permalinks off. The Buy Button and every “shop this” link in an email depend on them. Blocking the path would also block those.
CartWatch scores the checkout after Shopify creates it, tags the customer when it looks like a bot, and keeps that address out of Klaviyo, Omnisend, Mailchimp, Drip, and Brevo before a recovery send. On Standard and above, it can optionally delete the Shopify customer record of a very-high-risk bot. On plans that include it, payment blocking refuses the payment when they attempt it, so the order is never completed. The abandoned checkout row will still be there. Shopify writes it when contact details land. The order will not.
FAQ
What is a Shopify cart permalink?
A link in the form https://your-store.com/cart/VARIANT_ID:QUANTITY that preloads those variants. With no extra query, Shopify opens checkout. The admin calls the same thing a checkout link. Each visitor gets their own cart.
What does /cart/123:1 mean?
/cart/ is Shopify’s cart route, 123 stands in for a variant id, and :1 is a quantity of one. A real variant id is a long number such as 36485954240671. The product id is a different number and will not add the product. Threads that write /cart/:1 or /cart/PRODUCTID:1 mean this same path.
Does a cart permalink go to the cart or to checkout?
Checkout. Add ?storefront=true when you want the online-store cart page instead.
How do I find the variant id?
Open the product in the admin, open the variant, and copy the number after /variants/ in the address bar. More actions → Create checkout link (Buy Button channel) copies a full permalink with ?channel=buy_button already on it.
Can one permalink add more than one product?
Yes. Separate variants with a comma: /cart/111:2,222:1. Each pair is variant_id:quantity.
Is a cart permalink the same as an abandoned checkout link?
No. A permalink builds a new cart from variant ids. A recovery link (/checkouts/…/recover?key=…) reopens one checkout that already exists.
Why do abandoned-checkout bots use /cart/123:1? It is a public Shopify route that creates a checkout in one request. The theme never renders, so a captcha or an app embed on the product page has nothing to run against.
Will captcha stop bots that hit a cart permalink? Storefront captcha covers forms in your theme. This URL does not submit one. Shopify Plus bot protection is a scheduled checkpoint for drops, and Shopify describes it as a fairness control during a flash sale.
Can I turn cart permalinks off?
No. Buy Buttons and “shop this” links in email use the same route. There is no setting that disables /cart/{variant_id}:{quantity} without breaking those.
The URL in the thread is a feature. Path, variant, quantity, then checkout. CartWatch scores the checkout Shopify creates, tags likely bots on the customer, and holds them out of email before a send. On Standard, payment blocking refuses the payment when they attempt it. Install CartWatch from the Shopify App Store.