Action Required / Platform

Bots / Agents
must self-declare via "Web Bot Auth"
or they get the strictest rate limits

Shopify has begun applying strict rate limits to bots and agents that access the Storefront API and Shopify-hosted online stores. Unsigned requests are pushed into the strictest tier. If you want a higher limit, sign your requests with Web Bot Auth.

What's on this page
  1. What happened (in 30 seconds)
  2. How it works: signed vs. unsigned branching
  3. Traffic affected
  4. Signed vs. unsigned comparison
  5. Access tiers (Tier)
  6. Actions to take (3 steps)
  7. For merchants: if you want to crawl your own store
  8. 5 key points for developers
  9. 3 use cases you can apply at work
  10. One-line summary for proposals

1What happened

For bots / agents that access the Storefront API and Shopify-hosted online store pages, Shopify hasstricter rate limitsbegun applying them.
Unsignedrequests are locked into the "strictest tier."Signing with Web Bot Authmakes you eligible for a higher rate limit.

Unsigned bots: strong limits

Bots that don't identify themselves can't be attributed to anyone, so they fall into the strictest tier. Near-bombardment-level access is stopped here.

Signed with Web Bot Auth: higher limit

By cryptographically declaring whose bot it is, Shopify applies more lenient rate limits.

2How it works: signed vs. unsigned branching

Bot / Agent Crawlers, LLMs, etc. Shopify entry point Check signature header (Web Bot Auth) Signing key = whose bot it is Unsigned Signature valid Strictest rate limit Fewer req/sec More likely to return 429 Higher rate limit Comfortable req/sec headroom More stable operation Storefront API / Online store pages Shopify hosting side Starting point Entry check Allocated quota Destination
Web Bot Auth : A mechanism that lets a bot / agent declare "who it is" by signing with a cryptographic key. Shopify uses this signature to identify the requester and grants wider rate quotas to trusted parties. Cloudflare's implementation guide is provided as a reference (no registration with Cloudflare required, purely a reference for understanding the spec).

3Affected traffic

GraphQL

Storefront API

All clients that hit product, collection, inventory, and other data via GraphQL. Access from bots and agents is identified here.

Shopify-hosted online store pages

Public pages rendered by themes. All HTML that crawlers, scrapers, and LLMs fetch.

Bots / Agents in general

All non-human traffic reaching the store, including crawlers, search agents, and LLM-based fetching agents.

4Signed vs. unsigned comparison

ItemUnsigned (left unaddressed)Signed with Web Bot Auth
Rate limit Strictest The most restrictive quota A higher quota Relaxed
Identity identification Not possible (whose bot is unknown) Identified by the signing key
Operational stability Prone to stalling on 429s Runs reliably
Additional cost — Not specified
An even higher quota is needed — Can be requested from Shopify via a dedicated form

5Access tier (Tier)

L1
Unsigned
The strictest limits. The default for bots that don't identify themselves.
L2
Web Bot Auth signed
A standard, higher allowance. This is what most legitimate bots should aim for.
L3
High tier (by application)
If L2 still isn't enough, reach out to Shopify via a dedicated form.
The article doesn't list specific req/sec figures or numeric ranges for each tier. Check the "Storefront rate limits" documentation for details.

6Actions to take (3 steps)

1

Review the Web Bot Auth architecture

Understand the overall spec (keys, signature headers, verification flow).

2

Build it using Cloudflare's implementation guide as a reference

For reference only. You don't need to enroll with Cloudflare.

3

Send signed requests from your own bot

Always attach the signature when accessing the Storefront API / online store.

If L2's allowance still isn't enough,contact Shopify directly through the "dedicated form" referenced in the articleto discuss high-tier access equivalent to L3.

7For merchants: if you want to crawl your own store

Shopify admin offers a "ready-to-use Web Bot Auth signature"

Shopify merchants who want to crawl their own store can obtain a ready-to-use Web Bot Auth signature from the Shopify admin. You can apply it to your own crawler right away, without building your own key generation or implementation flow.

85 key points for developers

Action

1. This is an "Action Required" item

Shopify explicitly tags the announcement as Action Required. It assumes proactive action from those operating bots or agents. Leave it unaddressed and you'll be locked into the strictest allowance.

SIG

2. A "self-declaration" model, not authentication

Web Bot Auth isn't a mechanism for gaining permissions with an API key; it's a way for a bot to declare "who it is" via a cryptographic signature. Shopify allocates rate allowances based on that.

SF Web

3. It covers not just the API but public pages too

In addition to the Storefront API (programmatic access), it also covers the HTML pages of Shopify-hosted online stores. This includes the routes that LLM crawlers come through.

CF docs

4. No Cloudflare enrollment required

Cloudflare's guide is referenced as a sample implementation, but Shopify explicitly states it's "for context only / no need to enroll." You can implement Web Bot Auth yourself based on the standard spec.

5. If L2 isn't enough, an application route is available

If signing with Web Bot Auth still doesn't give you enough allowance, you can apply to Shopify for high-tier access through an individual form.For legitimate merchant-operated bots or large-scale product sync jobs, first meeting L2 and then negotiating L3is the realistic strategy.

93 use cases you can apply to your work

crawler.py SIG
USE CASE 1

Reliable operation of a competitor price and inventory monitoring bot

Challenge
A price and inventory monitoring bot that crawls a set of Shopify stores has been left unsigned, and it could eventually hit the strictest rate limits and stop with a barrage of 429s.
Solution
Build Web Bot Auth signing into the bot and attach the signature header to both Storefront API calls and HTML fetches.
Impact
Rate limits are relaxed and crawling stabilizes. Job failures and retries decrease, and data freshness is maintained.
Technical notes
If L2 still isn't enough, apply for L3-equivalent limits via the dedicated form. The Cloudflare guide is for reference only—no registration required.
LLM
USE CASE 2

Make your self-hosted LLM / AI agent's product data fetching "officially identifiable"

Problem
Your in-house RAG / AI agent is hitting Shopify's public pages and the Storefront API anonymously. As restrictions tighten going forward, there's a risk of fetch failures surfacing.
Solution
Implement Web Bot Auth signing where the AI fetching layer sends its requests. Consolidate key management and signature generation in a server-side proxy.
Impact
Beyond improved fetch reliability, you become a "clearly identified bot" from Shopify's perspective, letting you stay ahead of any further restrictions down the road.
Technical notes
Signing is per-request. Rather than direct calls from the LLM's raw responses (browser to store), a practical design routes through your own proxy and signs there.
Shopify admin Bot Auth signing
USE CASE 3

Merchant support: instant setup of a crawler for your own store

Problem
A Shopify merchant wants to run content fetching, sitemap generation, and internal-search crawling on their own site, but wants to avoid their own bot getting hit by the strictest rate limits.
Solution
Obtain the ready-to-use Web Bot Auth signature provided in the Shopify admin and embed it in your own crawler.
Impact
Since the merchant's own crawler can identify itself to Shopify as "belonging to my store," it can operate while keeping its rate limits secured.
Technical notes
Where to obtain the signing info / the exact screen path within the admin isn't stated in the article. You'll need to check inside the Shopify admin firsthand.

10One-line summary you can use in a pitch

"Bots / agents that access a Shopify store face the strictest rate limits unless they sign and identify themselves with Web Bot Auth..
Sign and you get higher limits; if that's not enough, you can apply via the dedicated form.
Merchants can rescue their own crawler simply by using the signature already provided in the admin.""