How to Sell Digital Downloads on Shopify Securely
Short answer: You can sell digital downloads on Shopify using its free Digital Products app or a third-party app. The built-in app handles files and download limits with no bandwidth cap. Add-on apps become worth it when you need expiring links, automatic revocation on refunds, buyer-stamped PDFs, protected course content, or your own storage bucket.
How do you sell digital downloads on Shopify?
Shopify’s own route is the Digital Products app. You install it, attach a file or link to a product, choose whether delivery is sent automatically or manually, then set the price and sales channels as normal. You can also add a download block to the thank-you and order status pages so customers get their file straight after paying.
According to Shopify’s documentation, each variant can hold up to 50 files with a combined size of 5 GB, or 500 MB per file if you add it from the product page. You can upload archives such as zip files, but not folders. And there is no bandwidth limit for downloads.
For a store selling a handful of small files, that is often all you need.
Are there limits on download access?
Yes, and they are worth understanding before you launch. By default, access is unlimited. You can switch it to limited and set a number of uses per customer. Shopify counts the limit per link, and each click on the download button counts as one use.
The same documentation doesn’t mention an expiry period for customers’ links. Share links don’t expire. To cut off a customer, you deactivate their link from the order page in the app.
None of this is a flaw. It is a sensible baseline. It just shows where the edges are, and whether those edges matter depends on what you sell.
When do you need more than the built-in app?
Think about what you are protecting. A free guide and a $400 course module have very different leak costs. A few situations that push people towards a dedicated app:
- Links should expire. A time limit narrows how long a shared link stays useful.
- Refunds should revoke access automatically. Doing it by hand works until you forget.
- You sell licensed PDFs. Stamping each copy with the buyer’s order number, and optionally their name, discourages passing it around.
- You sell course content. A protected link per file, usable only by a logged-in customer who bought the product, is closer to how people expect course material to behave.
- You want your own storage. Some merchants prefer to keep files in their own Cloudflare R2 account (a cloud file storage service) rather than a vendor’s.
Where does Vaulted Downloads fit?
Vaulted Downloads is a Shopify app I built for those situations. Files are stored in encrypted storage, either hosted by the app with nothing to set up, or in your own Cloudflare R2 bucket. Buyers get secure download links on the order confirmation email, the thank-you page, the order status page and in their customer account.
Features on the site include download limits, link expiry and automatic revocation on refunds and cancellations. PDFs can carry a footer added at download time and tied to the buyer’s order number, optionally with their name. Course content gets one protected link per file that works only for a logged-in customer who bought the product, and video streams in the browser with no extra app. An order lookup tool lets you reset a buyer’s downloads or revoke access. It advertises no bandwidth fees, and plans are listed on the site.
If you only sell a few low-risk files, the built-in app is probably the right call. I’d rather you know that than install something you don’t need. The thinking behind building apps like this is in when to turn a client problem into a Shopify app, and you can see both of my apps together in the Vaulted Downloads and Parcel Rules case study.
What should you check before you choose?
Before you commit to any option, run through this:
- File sizes and formats. Check the limits against your largest file.
- Bandwidth costs. Ask whether the provider charges for downloads. Shopify’s app doesn’t, per its documentation, but third parties differ.
- Where the files live. Hosted for you, or in your own storage?
- Refund behaviour. Automatic revocation or manual?
- Account requirements. Do buyers need to be logged in?
- What you’ll do when something goes wrong. A buyer will lose a link. How easily can you resend or reset it?
The last point matters more than people expect. Download problems tend to arrive as support emails, so the easier an app makes it to look up an order and fix it, the less time you lose. It is the same principle I describe in 5 signs your Shopify store has outgrown its setup: the cost of a tool is rarely the monthly fee. It’s the time spent working around it.
Need delivery that fits your product?
If you sell digital products and the standard tools don’t quite fit, have a look at how I approach Shopify and ecommerce projects, or tell me what you’re selling and I’ll help you work out the right setup.
Frequently asked questions
Can you sell digital downloads on Shopify?
Yes. Shopify's Digital Products app lets you attach files to products and deliver them to customers after purchase, on the order email, thank-you page and order status page. Third-party apps add features such as expiring links, automatic revocation on refunds and stamping files with the buyer's details.
Are there bandwidth limits on Shopify digital downloads?
Shopify's documentation says there is no bandwidth limit for downloads in its Digital Products app. File sizes are limited: up to 50 files with a combined size of 5 GB per variant, or 500 MB per file when added from the product page. Some third-party apps charge for bandwidth, so check each one.
How do I stop someone sharing a download link?
You can't make sharing impossible, but you can make it less useful. Set a download limit per customer, use links that expire, tie access to a logged-in customer account, and consider marking PDFs with the buyer's order number so leaked copies can be traced. Revoking access on refunds closes another gap.
What happens to a download when an order is refunded?
It depends on the app. With Shopify's Digital Products app you deactivate the customer's download link from the order page yourself, according to its documentation. Some third-party apps revoke access automatically when an order is refunded or cancelled, which saves a manual step and avoids forgotten links.
