Receiving intermittent 429 Errors with Shopify's admin/oauth/access_token API

Authentication & Access
1

Hi everyone,

I’m encountering an intermittent issue when attempting to exchange an authorization code for an access token using the Shopify admin/oauth/access_token endpoint. Over the past two days, there’s been an increase in HTTP 429 responses for this endpoint. In the 429’s responses, the response headers include cf-mitigated: challenge, suggesting that Cloudflare might be issuing challenges to these requests.

Notably, these endpoint responses lack the X-Shopify-Shop-Api-Call-Limit header that typically appears in API responses. The presence of the cf-mitigated: challenge header is interesting, but I’m not certain about the exact source of these 429 errors.

For context, we’re making on average 30–40 requests per hour to this endpoint for different stores, so the request frequency isn’t particularly high.

Questions:

  1. Has anyone else experienced similar 429 errors with the cf-mitigated: challenge header when interacting with Shopify’s OAuth endpoints?

  2. Could there be other causes for these 429 errors besides Cloudflare challenges?

  3. Are there any known limitations or special considerations for the admin/oauth/access_token endpoint that differ from other Shopify API endpoints?

  4. Has Shopify recently changed any policies or limits related to OAuth token exchange that might explain this behavior?

Any insights or recommendations on how to address this would be greatly appreciated.

Thank you!

4 Likes
2

We are also seeing this happen at a very elevated rate for the past 3-4 days

3

It definitely seems like 429 errors for retrieving access tokens has spiked anomalously, but may have been fixed already? Can anyone from Shopify comment on what might have happened here?

Here’s the past 15 days of the status codes we’ve been seeing on this endpoint from Shopify, see the big spike of orange (429) responses:

CleanShot 2025-04-25 at 21.50.07@2x
CleanShot 2025-04-25 at 21.50.07@2x3456×1422 224 KB

1 Like
4

@airhorns @gadget_kyle - We switched to using a residential proxy to solve this since it seems cloudflare is incorrectly identifying the app servers as a bot.

5

Terrifying. The issue has stopped for us since Apr 24, 14:00:00 EST as shown in that graph.

6

This error pattern has started happening intermittently again for us since about April 30th 3PM EST. It comes and goes and seems uncorrelated with the actual amount of traffic we’re sending to this endpoint.

7

Hey all - acknowledged on this issue and we are digging into it. We will report back once we have more detail.

8

FYI we believe we have resolved the underlying issue that was causing these 429 responses. Please let us know if this problem continues to occur, and thank you again for letting us know about it.

9

Still happening for me sir

10

Is it happening on this specific endpoint admin/oauth/access_token ?