Signed traffic, still measured.

NBT’s normal Shopify identity

Direct NBT crawler requests use Web Bot Auth. Shopify gives signed traffic a clearer identity and can apply different limits to it, but that is not a reason for us to send requests as fast as possible. robots.txt, site-level pacing, queueing and backoff still apply.

Shopify: bots and agents should identify themselves via Web Bot Auth ↗

Merchant crawler approval

A Shopify merchant can create a crawler signature for a connected storefront domain. If a customer gives that approval to NBT, we use it only for the domain it covers and only for the read-only requests it is meant for.

1. Open Shopify Admin.
   Sign in to the store you want NBT to test.
2. Open Online Store → Preferences.
   Shopify currently puts crawler access in the Online Store preferences area; the wording may move.
3. Create a crawler signature.
   Give it a clear name such as NBT storefront testing.
4. Choose the exact storefront domain.
   The approval is tied to that domain.
5. Choose how long it should last and create it.
   Store the generated values in NBT’s protected Shopify approval fields.
6. Revoke or replace it when needed.
   Do not send Shopify Admin passwords or private Admin API tokens instead.

Signature-Agent: "https://shopify.com"
Signature-Input: ...
Signature: ...

Shopify: Crawling your store ↗

What that approval does not do

• It does not give NBT access to Shopify Admin.
• It does not grant general access to orders or customer records.
• It does not override robots.txt or NBT traffic limits.
• It does not authorise payment or order submission.
• It does not let us ignore Shopify or Cloudflare protection decisions.