Aggressive bot detection with 429 errors AJAX Cart API

Online Store and Theme Development
103

To clarify the current status:

  1. Fixed: The regression that caused widespread 429s for real customers during normal cart interactions has been fixed. Normal cart activity should not generally trigger a 429. If it does, please share request IDs and reproduction details.

  2. Expected behavior: 429s can still be returned for bots and automation-like traffic, such as rapid, repeated add-to-cart requests. They may also be triggered when multiple apps make frequent cart requests. Storefront crawlers, testing scripts, and other automated tools should use Web Bot Auth to securely authorize their requests so they can be verified as coming from an authorized source.

  3. Not fully resolved: Some VPN users may encounter these challenges more often. VPN use does not automatically result in a 429, but there is not yet a complete solution for false positives.

  4. Mostly resolved for Shopify CLI: Upgrade to Shopify CLI 4.4.0 or later. These versions attach request signatures during shopify theme dev when using the default authentication method, making legitimate CLI traffic less likely to be rate limited. This does not yet apply when using --password with Theme Access. More details are available here.

Thanks for your patience while we continue improving the bot protection experience.