I have reproduced the issue on the latest CLI version.
Yes, I am on the latest version
I have searched existing posts and this report is not a duplicate.
Yes, this isn’t a duplicate
In which of these areas are you experiencing a problem?
Theme
Expected behavior
shopify theme dev’s local proxy (127.0.0.1:9292) should serve the storefront reliably. Its proxied requests should be treated as legitimate development traffic, not classified as unsigned bot traffic.
Actual behavior
Since the May 7 2026 stricter bot/agent rate-limit change (“Bots and agents should identify themselves via Web Bot Auth”), the proxy intermittently returns HTTP 403 and the “Your connection needs to be verified before you can proceed” interstitial, in bursts (200 → 403 → recover → 403). Triggered notably by app-driven /search?q=handle:… request salvos after each page load. Direct curl/browser traffic to the same storefront from the same machine returns clean 200 — only the theme dev proxy path is throttled. Shopify support confirmed this is a platform/CLI interaction, not user-side.
Reproduction steps
Run shopify theme dev (default --live-reload hot-reload) on a store with several storefront apps.
Open http://127.0.0.1:9292 and browse/reload normally.
Observe intermittent 403 bursts in the proxy log:
GET 200 /
GET 403 /search?q=handle:“product-a” OR handle:“product-b”…
POST 403 /apps//…
GET 403 /
GET 403 /favicon.ico
Browser shows “Your connection needs to be verified before you can proceed”. Direct curl https:// returns 200 from the same IP.
Verbose output
User-Agent: Shopify CLI; v=3.94.3
→ Rendering https://.myshopify.com/?_fd=0&pb=0 (with config/markets.json,config/settings_data.json)…
← 403 (request_id: null)
Render failed for / with 403 (x-request-id: null), trying proxy…
Proxy status: 403. Returning render error.
GET 403 /
GET 403 /favicon.ico
Admin GraphQL call (file upload) succeeded — response server-timing:
processing;dur=203, verdict_flag_enabled;desc=“count=19”;dur=1.676, graphql;desc=“admin/mutation/other”
x-request-id: bd87411a-8d9b-441a-a0e2-7b61ffb80411
(the “→ Rendering … ← 403 (request_id: null) … Proxy status: 403” block then repeats
continuously, ~3–5x/sec, for every theme dev render attempt)
Both the Section/Theme Render API and the proxy fallback return 403 with request_id: null, while a normal Admin GraphQL call from the same CLI run succeeds (200). The successful response carries server-timing: … verdict_flag_enabled;desc=“count=19” — indicating a server-side bot/security verdict system is actively flagging the CLI’s render/proxy traffic, even though the CLI sends User-Agent: Shopify CLI; v=3.94.3 (it identifies itself but does not sign via Web Bot Auth).
Operating system
macOS 15.6.1 (Sequoia)
CLI version
3.94.3
Shell
zsh
Nodejs version
v24.13.0
What language and version are you using in your application?
Node v24.13.0