We are seeing a surge of 429 errors across our stores today. Anyone else seeing this and having clients reaching out?
We are still seeing this issue in both development (shopify app dev) as well as production.
In development it’s very limiting, it makes it hard to test features thoroughly. I get rate limited almost immediately no matter what I do. I have upgraded to the CLI version 3.92.1 and still the same keeps happening.
In prod we have an alert for when this happens on live stores and we still see it happen quite often.
I’ve posted in the other channel as well but copying here Aggressive bot detection with 429 errors AJAX Cart API - #64 by Josh-Shopify
Please DM me or email me (josh.faigan@shopify.com) with your shopify store domain for the shop you are working on. IE (mystore.myshopify.com) so we can find your logs and continue investigating. Thank you!
Hi Everyone, we shipped some changes the other week that should help many cases of rate limiting via carts or regular sessions for those running theme dev. That does require you to be on version 3.92.1 or above.
If you are on the latest version, running theme dev commands, and still experiencing issues please ping me.
For those of you who have been affected by the same rate limiting who work on theme app extensions. If you run your sessions with app dev we would ask you try this latest CLI snap build. It should alleviate rate limiting for you. We would love feedback if you encounter any authentication issues or continued rate limiting in this version. We really appreciate your help here.
npm i -g --:registry=https://registry.npmjs.org /cli@0.0.0-snapshot-20260415172806
Side notes:
If you are experiencing issues only when using a vpn, we would like to know.
If you are experiencing issues when using markets, we would like to know.
This is happening to me as well starting today. I am getting the same as @Jonathan_Moore . Something has changed with the rate limits. I have been getting these errors all day with the page saying my connection needs to be verified. Super frustrating
Are either of you using the --password flag?
I am getting smashed with 429 responses now. I upgraded to the latest Shopify CLI version and am running 3.94.3.
It seemed to be better for a week but now I am am back to square one receiving 429 errors any time the cart has a few requests in a row.
I am then forced to use a VPN to get around the IP block but that workaround is short-lived after a few requests are made.
What is happening?
Same, completely blocked from working right now, with a go-live deadline tomorrow.
VPN does nothing for me.
I’m not using the --password flag.
I also just tried shopify auth logout and shopify auth login just in case. Always the first request goes through successfully and then the 429s hit.
• 08:18:14 Request » GET 200 / 1252ms
• 08:18:15 Request » POST 200 /shopify_pay/accelerated_checkout 244ms
• 08:18:21 Request » GET 429 /products/soulgazer-mascara 14ms
• 08:18:21 Request » GET 429 /favicon.ico 13ms
I’m also getting waves of 429’s - where I can’t use the cli/dev tool at all, and thus unable to get any work done. When trying to access anything in the browser, it just says “Your connection needs to be verified before you can proceed”. Without any available method of doing that. Tried updating the cli + logging out and back in again, with no change. Very frustrating.
I’m using the params --store [store myshopify url] --live-reload full-page --theme-editor-sync (no --password, or use of password on the target store)
Follow-up: any call to /cart.js or /cart/add.js triggers it… and then I get 429s on everything for 10 minutes plus. Don’t even have to do multiple requests. And I had no excessive activity against these endpoints prior to this behaviour starting. So your rate limiting is completely out of whack. Please fix, this is critical.
This is killing my productivity. Need this fixed ASAP! Please 
Here is my solution to the problem. Hope it helps you too.
Hi Everyone,
I’m on the team that owns the Theme CLI. Thank you for all your reports and insights and for bearing with us while we sort out this most recent flare up of CLI errors. We know it’s very frustrating and disruptive to your workflows and productivity.
I’d like to give you all some insight into what has been going on and what we’re trying to do about it
For this specific case
The 429s a number of you have been hitting with Shopify theme dev over the past week are caused by a UA-parsing bug on our side: when the CLI appends Shopify CLI; v=… to the end of an existing User-Agent string, our bot-detection sniffer misses it, so the request loses its CLI exemption and trips a complexity-based rate limit at the Cloudflare edge. Fix is up and will roll out shortly. In the meantime, switching from OAuth to a Theme Access password has been working as a workaround. We’ll follow up here once the fix is deployed.
This problem keeps happening, what are we doing about it?
Part of the challenge is that the theme CLI gets caught in the crosshairs of changes to bot detection. For various reasons, the theme CLI will get misidentified as bot traffic and that then impacts theme devs. We do have monitoring in place to see when it is happening and respond when we see spikes to identify what changed and why the CLI was impacted.
It will take more investment and coordination to have a more proactive rather than reactive approach to addressing this.
For future
We will keep monitoring this thread and others on the 429s
Some of you have been very kind to share logs directly with us in the past which have helped us sort out these issues. Thank you for that.
I do ask that you please refrain from emailing our dev directly unless we have requested it as it becomes quite noisy to sift through the logs we need vs general reports of issues.
Hi @stephanie-shopify, thanks for the response.
It is nice to know that the issue is being actively worked on.
I am no longer receiving any 429s and am exclusively receiving 403s for everything. I cannot develop at all as I am immediately blocked no matter if I change my IP address or switch to a Theme Access Password.
I will await the new fix and hope it is very soon.
Hi, I’m working on a Shopify app. The flow requires clearing the cart /cart/clear.js and then adding a product to the cart /cart/add.js, which worked perfectly fine last year. However, starting today, I’m seeing a 403 error on the add request with the message: “Your connection needs to be verified before you can proceed.”
Hi, same here. I cannot develop at all like @sanico_software. I’m receiving 403s for almost everything.
EDIT: Also, if local works for a while somehow, adding a product to the cart is impossible.
My current workaround for this issue is to use the preview theme (clicking p in the cli), it doesn’t have a hot reload but it does allow me to get some work done. Hope it helps!