Aggressive bot detection with 429 errors AJAX Cart API

i can’t use cli at all. as soon as i run it. i am really getting tired of this.

**

Update: Sharing a workaround that got me unblocked today, in case it helps others hitting the same wall.

**

My CLI was on 3.94.3 (well past the 3.92.1 rate-limit fix), and the 429s had cleared. However, as soon as I ran shopify theme dev, the session failed with a different pattern:

  • 400 on /sf_private_access_tokens
  • Cascading 403s on section requests (?sections=side_cart, ?sections=product_card_ajax, etc.)
  • 502 Bad Gateway with TypeError: Response body object should not be disturbed or locked (undici extractBody)
  • TypeError: fetch failed on /cart/add.js

Clearing the local auth (shopify auth logout, removing ~/.config/shopify and ~/.cache/shopify) and re-authenticating did not resolve it. The CLI could not retrieve a valid storefront access token via OAuth, and everything cascaded from there.

What worked: switching to a Theme Access password instead of OAuth.

  1. Install the Theme Access app on the store from the Shopify App Store.
  2. Generate a password for your collaborator or staff email. You will receive a token starting with shptka*********************
  3. Run theme dev with the token:

This bypasses the sf_private_access_tokens flow entirely. theme dev started cleanly, cart requests worked, and the undici 502 crashes stopped immediately.

Hope this helps anyone else stuck on the same error pattern while a proper fix is in progress.