Bots and agents should identify themselves via Web Bot Auth
Shopify developer change
MerchantDiff detected this entry in Shopify's official developer changelog on May 07, 2026.
This Shopify update is categorized as Action Required, Platform, Update.
What changed
Shopify now applies stricter rate limits to bots and agents that access the Storefront API and Shopify-hosted online store pages. Bots and agents that don't sign their requests are subject to the strictest limits. To qualify for higher rate limits, operators should sign their requests with Web Bot Auth. For more details, see Storefront rate limits.
Who is affected
Apps and storefronts using the affected Storefront API surface should review this change.
What action may be needed
If you operate a bot or agent accessing Shopify storefronts, sign your requests using Web Bot Auth. To get started, review the Web Bot Auth architecture and Cloudflare's implementation guide — for context only, you do not need to enroll with Cloudflare. Higher access tiers If you require higher rate limits than those provided to Web Bot Auth traffic, please contact us through this form.
Use the official Shopify entry below as the source of truth for technical implementation details, affected APIs, migration instructions and deadlines.
Want the actionable version?
MerchantDiff monitors Shopify API changes, deprecations, deadlines and ecosystem updates, then turns them into developer-focused release intelligence: what changed, who is affected and what action may be needed.
Get MerchantDiff →