How do share links and share APIs work?

Every wishlist has a public hash based link, and share by email is an API call away. This reference documents the link format, the share page, the share by email endpoint behavior, and what is possible for custom landing pages today.

The share link format

https://your-store.com/a/wishlist-hero/wishlist/shared/your_wishlist_hash

• The hash is the wishlist’s public identifier, the same value the REST API and SDK use
• The link renders inside your theme layout: your header, footer, and styling
• Anyone with the link sees that list; there is no auth and no password option

You can get a hash from the REST API (CreateOrGetExisting ), the SDK (GetWishListHash ), or the share popup the shopper uses.

What the share page shows

The share page renders the wishlist read only: product cards with image, name, price, and add to cart, but no remove controls and no list level actions. Out of stock items are marked. The shopper who owns the list sees the full editing UI at the regular wishlist URL instead.

Share by email

Shoppers share by email through the app UI, which posts to an internal endpoint that:

• Accepts up to three recipient addresses per share
• Sends the merchant customized share template, with the shopper as reply to
• Records a share event in the activity log
• Fires the Wishlisthero-sharewishlist  trigger when Klaviyo or Omnisend is the email provider

The endpoint is internal to the storefront widget and not part of the public REST contract; trigger the same behavior from custom UIs by opening the app’s share popup with the wishlist-hero-open-share-popup  document event rather than calling the endpoint directly.

Custom landing pages

Two supported patterns today:

• Frame the share page: link shoppers straight to the share URL. It is already theme rendered, so it reads as a native page.
• Fetch and render yourself: with the REST API, pull Wishlist/:Hash/items  and render your own landing page, mobile app screen, or kiosk view. Attribute cart intent with addToCartNotification  so reporting stays complete.

Building a fully custom hosted landing route and pointing share links at it is not configurable in the app; the share path is app managed. If a custom share domain matters for your project, raise it with support.

Privacy notes for developers

• Share links are capability URLs: possession is authorization. Do not log full share URLs where third parties can read them
• Shopper email and name on the wishlist are stored encrypted; the share page never exposes them
• Removing an item from the list updates the share page instantly, so printed or cached copies age out