Aggressive bot detection with 429 errors AJAX Cart API

Online Store and Theme Development
67
68

I donā€™t understand how Shopify expects developers to support themes if we are getting rate limited in a local development environment. I respect that you (@Paige-Shopify) are doing your best to respond in this thread but this problem is getting out of hand. It has become unsustainable to develop and test a theme on Shopify. What is the fix because I am honestly extremely frustrated as a developer. I ask you to please not link me to this help article too because it has not resolved the issue.

69

Hi @sanico_software, we have recently shipped another fix for local theme development. Can you confirm if upgrading to the latest CLI version resolves the issue for you?

If not, Josh is looking for further feedback through the thread Luke linked above.

70

Issue has been opened in January and still not fixed.

image
image1138Ɨ373 15 KB

Iā€™m not even able to access localhost to work on theme.

71

Hi @Nikola_Markovic, are you encountering this issue before cart actions?

72

Yes, we are developing a custom theme using vite and page reload, and lately itā€™s been a pain, after 30 minutes of work it starts blocking us.

73

Thanks for sharing!
Weā€™re working on an update to resolve this issue and will provide an update here when itā€™s available.

74

Iā€™ve not seen this error for a few months but my colleague and I have both experienced it this morning.

Very frustrating for such a major bug to return. I donā€™t care if the screen shows up, just display the cloudflare captcha too!

75

Noticed this popping up today randomly for multiple people, and we are blocked out of the local development store. The Cloudflare captcha tool is not visible either.

On the latest version 3.94.3. Weā€™ve cleared any data, restart dev servers, re-authed, closed and tried different browsers, and still unable to access it.

76

same issues here too.

77

Same issue here, cannot work at all with the CLI. It s not showing the cloudflare captcha, and repeated on all stores / themes I tried

79

@Paige-Shopify I did upgrade but to no avail. I commented on the other thread for their help as per your recommendation.

I understand you are support staff so I am not angry with you personally and appreciate your assistance. Separately, I am very infuriated with the situation as it has made it extremely difficult to develop on the platform.

I am unsure if this is a desire of Shopify to phase out theme developers and rely more on the new inbuilt AI tools? Might be a stretch but this issue has gotten out of hand. It was first posted in January 2026 and it has been 4 months.

What is the recommendation from here?

80

Iā€™ve noticed this issue at the start of this week, but in my case I canā€™t access any page on shopify theme dev, I immediately get redirected to /cart and hit with the 429

81

After refreshing the page a few timesā€¦
It gets stuck in an endless loop of ā€œ429 Too Many Requests.ā€
It completely kills my productivityā€”I canā€™t get any work done at all!

82

i canā€™t use cli at all. as soon as i run it. i am really getting tired of this.

**

Update: Sharing a workaround that got me unblocked today, in case it helps others hitting the same wall.

**

My CLI was on 3.94.3 (well past the 3.92.1 rate-limit fix), and the 429s had cleared. However, as soon as I ran shopify theme dev, the session failed with a different pattern:

  • 400 on /sf_private_access_tokens
  • Cascading 403s on section requests (?sections=side_cart, ?sections=product_card_ajax, etc.)
  • 502 Bad Gateway with TypeError: Response body object should not be disturbed or locked (undici extractBody)
  • TypeError: fetch failed on /cart/add.js

Clearing the local auth (shopify auth logout, removing ~/.config/shopify and ~/.cache/shopify) and re-authenticating did not resolve it. The CLI could not retrieve a valid storefront access token via OAuth, and everything cascaded from there.

What worked: switching to a Theme Access password instead of OAuth.

  1. Install the Theme Access app on the store from the Shopify App Store.
  2. Generate a password for your collaborator or staff email. You will receive a token starting with shptka*********************
  3. Run theme dev with the token:

This bypasses the sf_private_access_tokens flow entirely. theme dev started cleanly, cart requests worked, and the undici 502 crashes stopped immediately.

Hope this helps anyone else stuck on the same error pattern while a proper fix is in progress.

84

Hitting ā€œYour connection needs to be verified before you can proceedā€ constantly using the latest version of the CLI, though mine is failing with 403s.

Ridiculous workaround, but if you turn your VPN on or off every time it happens, you get a few more reloads.

85

429 errors affecting real shoppers have been resolved. The remaining issue is CLI-specific, and weā€™re still working on a proper fix. Thanks to @bakin11 for sharing a great workaround, which Iā€™d recommend following to get unblocked in the meantime.

To keep CLI discussion in one place, Iā€™m going to close this topic in favor of 429 Too many requests. Please continue the conversation there. Thanks!

86

Thanks, Paige ā€” glad if it helps others get unblocked while the proper fix lands. Happy to share more logs from my store if it would be useful to your team.

87

@Paige-Shopify Interesting. After updates to CLI 429 stopped completely, recently we got hit with 403 after couple refreshes.

88

@mrkaluzny does the 403 error render at all so you can resolve the challenge? Or are there multiple returning for background requests?