Drink Caveman

A token is a base64url payload carrying a version, a campaign name, an expiry timestamp and a random nonce, followed by an HMAC-SHA256 signature over that payload. A command-line tool mints one for a named campaign with a lifetime in days: 30 days for a Meta ad set, 365 for the evergreen link in Klaviyo flows, one day for a smoke test. A companion tool verifies any full URL. Ten unit tests on the Node test runner cover the acceptance and rejection cases: valid, expired, wrong secret, tampered payload, no separator, empty, null, missing campaign, unknown version, and that the TTL is reflected in the expiry.

The ad or email link points at a Cloudflare Worker's verify route with the token and UTM parameters. The Worker checks the signature, version, expiry and campaign field. On success it sets a signed session cookie and answers with a 302 to the bundle collection on the store, appending a flag and passing the UTMs through. On failure, whether expired, forged or replayed, it 302s to the homepage. A separate check route reports whether the visitor holds a valid cookie, kept available as a fallback path. The Worker runs on a workers.dev subdomain, so the store's DNS was never touched, and staging and production Workers are deployed under separate names.

The live theme was duplicated and the duplicate received a single, delimited block in the head of the theme layout. Guarded by Liquid conditionals, it has no effect anywhere outside the funnel. When the redirect flag is present, an inline script sets a sessionStorage marker and adds a class to the root element; every page in that tab then renders in funnel mode. Scoped CSS hides the desktop header, footer, app-injected announcement bars, cart and size-guide drawers, quiz overlays and search, while leaving the mobile nav bar with only a hamburger and a cart icon. The bundle link is hidden from every navigation menu site-wide and the collection is disallowed in robots.txt with a noindex meta tag.

On the cart page, the same class hides the chrome and the redundant update button, and quantity buttons are intercepted so each change posts to the cart API and reloads, keeping the visible subtotal accurate. Checkout is the only remaining exit.

The store-specific values are tabulated in one place: the gated path, the fallback URL, the origin host, the header section selector, the URL flag convention. The runbook explains how to gate a second page, when to re-duplicate the theme after a live-theme change, and what shipping changes do and do not require. The generalised procedure was extracted into a separate gated-URL playbook so the same pattern can be applied to any Shopify store.