What Shopify shipped, and why the hand-off matters
According to Shopify's developer changelog, Shopify storefronts now support the UCP capability dev.ucp.shopping.permalink on a new /buy route, starting with UCP version 2026-08-25. Shops list the capability in their UCP discovery profile at /.well-known/ucp, and the capability's config.endpoint points to the shop's /buy route. The changelog says a single /buy link can add items to a cart, prefill checkout details and take the buyer to checkout, and that the same link format works on any shop that supports UCP.
Our read is that this standardizes the last step between an AI agent's product recommendation and a filled cart. With /buy, generating the link is no longer the difficult part of a hand-off. The difficult part is putting the correct variant ID in it, and that depends on how accurate the product data was when the agent read it.
The changelog states that existing /cart permalinks keep working and that Shopify still supports them. It now calls /cart the legacy format, and new capabilities will be added to /buy only. /buy does not yet support selling plans, line item properties, cart notes or cart attributes.
How a /buy link is built
The changelog gives two encoding rules. Items go in the URL path as token:quantity pairs. All other cart and checkout fields are set with query parameters named after their UCP field path. The changelog's examples are buyer/email and discounts/codes/0. It lists six things a /buy link can do:
| Capability | What the changelog states | Likely use (our read) |
|---|---|---|
| Add items | One or more items by variant ID | Agents building multi-item draft carts |
| Prefill buyer details | Such as email address | Fewer fields to fill in for a known buyer |
| Set locale | Buyer's country and language | Cross-border buyers landing in the right market |
| Apply discounts | Discount codes | Agents and affiliates passing a promo through |
| Wallet preference | Indicate a preference for Shop Pay | Steering agent-originated checkouts toward Shopify's wallet |
| Redirect | Send the buyer to a specific page with continue_to | Campaigns that want a landing page instead of checkout |
Two parts of the guidance matter for integration code. First, the changelog advises agents to read config.endpoint from the shop's discovery profile instead of building the /buy URL themselves. Second, it states that permalinks don't use capability negotiation, so an agent does not need to declare dev.ucp.shopping.permalink in its own agent profile. Discovery means reading one well-known file. There is no handshake.
The changelog also says what happens when a link fails. If a link can't be applied, Shopify redirects the buyer to the continue_to destination if one is set, or to the shop's storefront if not, instead of showing an error page. The changelog text does not define the "token" in the path pairs beyond saying that items are added by variant ID.
/buy versus the legacy /cart format
| Aspect | /cart (legacy) | /buy |
|---|---|---|
| Status per the changelog | Still supported, now called the legacy format | New route for the UCP permalink capability |
| Discovery profile endpoint | Not the listed endpoint | config.endpoint points here |
| New capabilities | None; they go to /buy only | Yes |
| Selling plans, line item properties, cart notes, cart attributes | Use /cart for these, per the changelog | Not yet supported |
| Existing integrations | Keep working without changes | Recommended for new links |
The changelog recommends using /buy for new links and moving existing /cart links to /buy where possible, on the integrator's own schedule. It names no retirement date for /cart.
What it means for ecommerce brands
Variant data becomes the cart
/buy adds items by variant ID. An agent that matched the wrong variant (wrong size, wrong colorway, a discontinued option) will create a link that adds the wrong product or fails. Our expectation is that clean, consistent variant data now affects conversion directly, not only discovery. Our coverage of multiple barcodes on Shopify variants covers a related part of variant-level data hygiene.
Subscription brands stay on the legacy format
Brands that sell through selling plans cannot use /buy for those purchases yet, according to the changelog. Agents linking to subscription offers have to use /cart, which will not get new capabilities. The same applies to flows that rely on line item properties for engraving, personalization or bundle metadata.
Failed links don't produce errors
Redirecting to the storefront is better than an error page for the buyer. The practical downside is that a stale or malformed agent link can drop a buyer on the homepage with an empty or partial cart, and nothing marks that as a failure. In analytics it can look like ordinary homepage traffic that didn't convert.
Shop Pay has its own parameter
The Shop Pay preference parameter gives Shopify's wallet a dedicated place in the standard hand-off link. The changelog does not say how strongly checkout applies that preference.
The strategic read
A permalink is the lowest-friction form of agent checkout. Any agent that can output a URL can use it, with no session or tool call required. Shopify's more involved UCP surfaces, covered in our pieces on buyer consent in Checkout MCP and Cart MCP and the move from the Global Catalog REST API to UCP MCP, serve agents that hold a running session. Our read is that /buy covers everything else: a chat answer, a shared recommendation, an email, a QR code.
Once every UCP-supporting Shopify shop publishes its /buy endpoint in the same place, cart links work the same way across shops. Product data quality is what still differs.
We expect /cart to fall behind over time even though it remains supported, because every new capability is reserved for /buy. Brands whose revenue depends on features /buy lacks should track Shopify's roadmap for those features closely. We also expect the per-shop integration cost for shopping assistants to drop, since reading one field from /.well-known/ucp replaces learning each shop's cart URL behavior. More agents will be able to send buyers to checkout as a result. Whether a given brand benefits depends on whether those agents can identify the right variant to add.
What Shopify has not said yet
- Go-live date. The changelog says storefronts "now support" /buy but gives no date. 2026-08-25 is a UCP specification version, not a rollout date.
- Which shops qualify. The source doesn't say which shops count as supporting UCP, whether merchants have to enable anything, or whether they can opt out.
- Token format. The text doesn't define the token in
token:quantity. - Older UCP versions. It doesn't say how agents on UCP versions before 2026-08-25 interact with /buy.
- Headless and Hydrogen. It doesn't confirm whether /buy behaves the same on headless storefronts as on theme-based Online Store storefronts.
- continue_to scope. It doesn't say whether destinations are limited to the shop's own domain.
- Shop Pay preference. It doesn't say whether this is a hint or changes the checkout flow.
- Timelines and attribution. There is no date for selling-plan support on /buy, no deprecation date for /cart, and no description of how /buy sessions are attributed to referring agents.
The full parameter list is in Shopify's linked Cart and checkout permalinks documentation and the UCP permalink specification, neither of which was in the source material reviewed for this article.
What to do this week
- Inventory your /cart links. Check email flows, ads, influencer links, QR codes and partner integrations. Mark which ones depend on selling plans, line item properties, cart notes or cart attributes.
- Plan the move to /buy for the rest, as the changelog recommends, on your own schedule. Keep /cart for subscription offers and personalization flows until Shopify announces support on /buy.
- Check your discovery profile. Open
/.well-known/ucpon your domain and confirm it listsdev.ucp.shopping.permalinkwith aconfig.endpointpointing to /buy. - Brief your agency and app developers. Ask them to read
config.endpointfrom the profile instead of hardcoding /buy URLs, per Shopify's guidance. - Remove personal data from shared links. The changelog advises against putting buyer details in widely shared links and against ever including payment credentials or access tokens.
- Audit variant data. Make sure variant titles, options and availability are accurate and consistent, because agents build /buy links from the variant IDs they can read. The product-level visibility checks for Shopify are a place to start.
- Watch for unexpected homepage landings. Look at agent and campaign traffic that reaches the storefront root when it should have reached checkout. Silent fallbacks are designed to look normal.
Frequently asked questions
What is the Shopify /buy permalink?
Per Shopify's developer changelog, /buy is a new storefront route that implements the UCP dev.ucp.shopping.permalink capability, starting with UCP 2026-08-25. One /buy link can add items by variant ID, prefill buyer details, set country and language, apply discount codes, indicate a Shop Pay preference and send the buyer to checkout or to a page set with continue_to.
Do existing Shopify /cart permalinks stop working?
No. The changelog states that existing /cart permalinks keep working and that existing integrations need no changes. Shopify now calls /cart the legacy format, and new capabilities will be added to /buy only.
Can a /buy link add a subscription product?
Not yet. The changelog states that /buy does not support selling plans, line item properties, cart notes or cart attributes, and that /cart should still be used for those features.
How does an AI agent find a shop's /buy endpoint?
The changelog advises reading config.endpoint for the dev.ucp.shopping.permalink capability in the shop's discovery profile at /.well-known/ucp, instead of building the URL directly. Permalinks don't use capability negotiation, so agents don't need to declare the capability in their own agent profile.
What happens when a /buy link can't be applied?
According to the changelog, Shopify redirects the buyer to the continue_to destination if one is present, or to the shop's storefront if not, instead of showing an error page.
Ask AI about this
Ask an AI engine how Shopify's /buy permalinks and UCP discovery work for your store, and whether your /cart links should move.