Link Selling: Sell Access to Any URL as a Digital Product

Digital products are not just files anymore. Merchants today sell access to online courses on Teachable, invite-only Discord communities, private Google Drive folders, Notion workspace templates, Zoom webinar recordings, and membership portals. Until now, if you wanted to sell URL-based access alongside traditional file downloads on Shopify, you needed either a premium-tier app or a completely separate tool.

Today we are shipping Link Selling in Alva Digital Downloads — a first-class way to sell access to any external HTTPS URL as a digital product. This post covers what it is, how we built it, the security model, and why it matters competitively.

The Problem

A growing number of Shopify merchants sell "digital products" that are not files at all. A fitness instructor sells access to a private Facebook Group. A designer sells a Notion template by sharing a workspace link. A SaaS founder sells early access to a beta portal. An educator sells a Teachable course enrollment link.

These merchants have been forced into awkward workarounds:

• Manual email workflows: Fulfilling orders by hand, copying and pasting URLs into emails.
• PDF wrappers: Uploading a PDF that contains nothing but a hyperlink, which customers download, open, and click through. Terrible UX.
• Separate apps: Installing a dedicated link-selling app (like LinkIT at $14.99–$29/month) on top of their existing digital downloads app.
• Premium tier lock-in: Upgrading to the highest tier of a competing app just to unlock link delivery.

All of these approaches are fragile, expensive, or both. They fragment the merchant's workflow across multiple tools and create a worse experience for customers.

What Link Selling Is

Link Selling lets merchants attach external URLs to Shopify products alongside (or instead of) traditional file downloads. When a customer purchases a product with links attached:

1. The links appear on the download page as styled buttons with an external link icon
2. The links are included in the delivery email alongside file download buttons
3. The links appear in the customer account extension (order status page)
4. Clicking a link routes through a secure redirect endpoint that validates access, checks visit limits, records the visit, and then redirects to the external URL

A single product can now have files, packs (bundles), and links attached to it simultaneously. Or it can be link-only — no files required at all.

Feature Overview

Links Management

A new "Links" section appears in the admin navigation. The links index page shows all links with title, truncated URL, visit count, product attachment count, and category assignment. Bulk selection and delete operations are supported.

Link Create/Edit

The link editor provides:

• Title (required): Display name shown to customers
• URL (required): Must be HTTPS. Validated at input, at save, and again at redirect time
• Button Label (optional): Custom text for the button customers see. Falls back to the title if not set
• Description (optional): Internal notes for the merchant
• Category (optional): Organize links using the same category system as files

Access Controls

Each link has three independent access control mechanisms:

• Visit Limit (maxVisits): Maximum number of times the link can be accessed per purchase. Set to 1 for one-time-access links, or any integer for limited access. Leave empty for unlimited.
• Duration Expiry (expiresAfterHours): Link expires N hours after the purchase date. Useful for time-limited webinar access or trial periods.
• Calendar Date Expiry (expiresOn): Link expires on a specific date regardless of purchase date. Useful for cohort-based courses or seasonal content.

These can be combined. A link can have both a visit limit of 3 and a duration expiry of 72 hours — whichever limit is hit first takes effect.

Product Attachment

Links are attached to products using the same product mapping UI that files and packs use. The product mapping page now shows three sections: Files, Packs, and Links. A product can have any combination of the three.

Customer Experience

Download Page

Links appear on the download page below any file download buttons. They are rendered as outline-style buttons (transparent background, colored border) with an external link SVG icon — visually distinct from the solid-fill file download buttons. This makes it immediately clear which items are downloadable files and which are external links.

If a product has both files and links, a "Your Links" heading separates the two sections. If a product is link-only, the links appear directly without a separator.

Delivery Email

Links are included in the download email using a distinct outline-button styling with an external link indicator, making them easy to distinguish from file download buttons. The email template is optimized for compatibility across all major email clients.

Customer Account Extension

Links also appear in the Shopify customer account page (order status) through the existing account extension. Customers can re-access their purchased links at any time without searching for the original email.

Secure Access

When a customer clicks a link, they do not go directly to the external URL. Instead, the click routes through a secure redirect endpoint that validates the customer's access, checks visit limits and expiry, and records the visit before granting access. This ensures that only paying customers can access purchased links.

Security

Security was a primary design concern for link selling. The system includes multiple layers of protection:

• HTTPS-Only URLs: Only secure HTTPS URLs are accepted. URLs are validated at input, at save, and again at redirect time.
• XSS Prevention: All merchant-controlled strings (titles, button labels, URLs) are properly escaped to prevent cross-site scripting attacks.
• Atomic Visit Tracking: Visit limits are enforced atomically to prevent concurrent access from bypassing limits. If a link has a visit limit of 1, exactly one visit will be recorded even if a customer opens multiple tabs simultaneously.
• Fraud Prevention: Link access integrates with the existing fraud prevention system. Orders flagged by fraud detection cannot access links until the merchant manually approves the order.
• Referrer Protection: The redirect page suppresses referrer headers to prevent external URLs from seeing customer access tokens.

Full Internationalization

All user-facing text — admin UI, download page, email content, and error messages — is fully translated across all supported locales. Customers see link-related messages (access errors, redirects, expiry notices) in their own language.

Use Cases

Link selling opens up a wide range of product types that merchants can now sell through their Shopify store:

• Online Courses: Sell enrollment links to Teachable, Thinkific, Kajabi, or Udemy courses. Set a visit limit of 1 for one-time enrollment.
• Community Access: Sell invite links to private Discord servers, Facebook Groups, or Slack workspaces. Use duration-based expiry for time-limited trials.
• Cloud Storage: Sell access to shared Google Drive folders, Dropbox links, or OneDrive directories containing resources and templates.
• Webinars and Events: Sell access to Zoom meetings or event registration links. Set a calendar date expiry to disable access after the event.
• Notion Templates: Sell Notion template duplication links. Customers click once to duplicate the template into their own workspace.
• Membership Sites: Sell registration links to membership portals or Patreon pages.
• Software Portals: Sell access to software download portals, license activation pages, or SaaS onboarding flows.
• Hybrid Products: Combine files and links in a single product. Sell an e-book PDF alongside a private community invite link. The download page renders both seamlessly.

If you are a Shopify merchant selling digital products — whether they are files, links, or both — install Alva Digital Downloads and try link selling today.