Short description of issue
I run CoralBay UK (https://coralbay.uk), a directory linking shoppers to UK reef retailers. Each night it reads public products.json feeds from about 30 Shopify stores. Those storefronts now return HTTP 429 (retry-after: 60) to my crawler even at very low request rates. My Web Bot Auth signatures validate on Cloudflare’s debug page. Is my signature recognised by Shopify as verified traffic, and what should I do next? I’m a third-party operator, not a merchant.
Link to Shopify Store
https://signaturefrags.com (representative store; I don’t administer it)
Reproduction steps
- From my hosted UK server, send one signed GET to https://signaturefrags.com/collections/all-lps/products.json?limit=1
- Result: HTTP 429 at Mon, 05 Oct 2026 09:59:34 GMT. retry-after: 60, content-type: text/plain, x-request-id: d0c769c7-c60e-4c61-90a3-db838b25a0a2-1791194374, cf-ray: a45b930b2c99bf04-LHR
Additional info
Identity: User-Agent CoralBay Intelligence Discovery Engine Fetch (+https://coralbay.uk/); Signature-Agent “https://coralbay.uk”; directory https://coralbay.uk/.well-known/http-message-signatures-directory; key ID uaWthzvmP94U16vZzVWrk31CvRrtkJwIVkrhp0JgWHM (Ed25519); covered @authority and signature-agent; tag web-bot-auth; 120 s lifetime. Cloudflare’s debug page reports “Signature is valid” for a captured request (screenshot attached).
Behaviour: public catalogue data only, no logins or checkout. One request at a time across all Shopify stores, now one every 30 s or slower, with automatic back-off after any 429.
Same server and IP: signed and unsigned requests with the same User-Agent got identical 429s. Higher-access form submitted [date], no reference number.
Questions and further details are in my first reply below.
What type of topic is this
Troubleshooting