Short description of issue
WheyRadarBot reads public product data from 6 Shopify stores; every request from the bot gets HTTP 429, signed or not. Is our signature recognised as verified traffic, and what should we do next?
Link to Shopify Store
Reproduction steps
One signed GET to https://www.bodyandfit.com/fr-fr/products/whey-perfection.js
Result: HTTP 429 at 2026-11-01 08:21:47 UTC, retry-after: 60, x-request-id: 5d63f0c2-9bd7-4ccd-91e9-ebedeb80757c-1793521307, cf-ray: a5397ceafeaec653-CDG
Additional info
I run WheyRadar (https://wheyradar.com), a French price comparison site for sports supplements. I am a third-party operator, not a merchant, and I don’t administer these stores.
User-Agent: Mozilla/5.0 (compatible; WheyRadarBot/1.0; +https://wheyradar.com/robot)
Signature-Agent: “https://wheyradar.com”
Directory: https://wheyradar.com/.well-known/http-message-signatures-directory
Key ID: M7nbe8nqpF3f2KhrujIBk09uARZzilYf5IxGJsiQUxI (Ed25519), covers @authority and signature-agent, tag web-bot-auth, 60 s lifetime.
Cloudflare’s debug page reports “Signature is valid” for a generated request. The bot reads robots.txt and stops after 3 refusals. Registration form submitted on 2026-10-30.
Could someone check whether our signature verifies on your side? Happy to send fresh captures privately.
What type of topic is this
Troubleshooting