Get Download Link

get_download_link returns an encrypted CartThrob action URL for one validated download source. Use it where a reusable link is necessary. For a button that does not expose a reusable URL, prefer download_file_form.

Source validation and customer authorization are separate. Render the tag only in a verified purchase/member context, and add a member or role restriction when the generated link must not be transferable.

Use this tag when you want a clickable/shareable download link (for example in account, invoice, or order-email templates). If you do not want a visible link, use download_file_form instead.

This tag is a single output tag (not a form tag).

See also:

• download_file_form
• downloads tag index
• order_items

Parameters

• entry_id
• field
• file
• free_file
• member_id
• role_id / group_id
• language
• debug

entry_id

The current-site entry containing the named download field. Use with field.

entry_id="{item:entry_id}"

field

The field short name on the entry’s channel. ExpressionEngine File and CartThrob Download fields are approved automatically. Other fieldtypes require an exact channel/field entry in cartthrob_download_fields.

field="product_download"

When field and entry_id are provided, CartThrob resolves only that field. A missing/blank/unusable field does not fall back to an unrelated literal source.

Without member_id, role_id, or group_id, a field-based link is intentionally unrestricted and can be used by anyone who receives it.

file

A direct managed-file reference, approved absolute local path, or approved HTTP(S) URL. A direct protected link must also include member_id, role_id, or group_id; otherwise the download action rejects it.

file="/srv/private-downloads/manual.pdf"

Direct parameters bypass field approval but never bypass source validation.

free_file

An explicitly unrestricted source. This parameter removes member and role restrictions by design. Use it only when anyone possessing the URL may download the file.

free_file="{filedir_3}public-guide.pdf"

CartThrob never populates free_file from a product field.

member_id

Restricts the generated link to the member. CURRENT_USER, {member_id}, and {logged_in_member_id} resolve to the current member.

member_id="CURRENT_USER"

role_id / group_id

Restricts the link to one or more ExpressionEngine role IDs. role_id is the current name; group_id remains as its legacy alias. Separate multiple explicit IDs with a pipe.

role_id="6|8"

language

Chooses the language used for download validation messages.

language="en"

debug

Outputs source-resolution diagnostics instead of a normal link when file or field resolves the source. It does not diagnose free_file. Use only during development; diagnostics can reveal filesystem details.

debug="yes"

Recommended purchased-download example

{exp:cartthrob:order_items member_id="CURRENT_USER"}
    <a href="{exp:cartthrob:get_download_link
        field='product_download'
        entry_id='{item:entry_id}'
        member_id='CURRENT_USER'}">
        Download {title}
    </a>
{/exp:cartthrob:order_items}

The surrounding order_items query establishes which purchased items may be shown; the link’s member restriction prevents a copied URL from working for another member.

Source requirements

See Downloadable products for managed files, roots, origins, redirects, and blocked sources, and Configuration Overrides for every supported override and example. An encrypted link cannot authorize a path or URL that fails the CartThrob 10 source policy.