Shopify Storefront API · Rate Limits

Shopify Storefront API Rate Limits

Shopify documents that the Storefront API has no rate limits applied on the number of requests. Suspicious traffic can be rejected with 430, and there is a per-minute checkout creation throttle that returns a 200-with-Throttled error when exceeded.

Shopify Storefront API Rate Limits is the machine-readable rate-limit profile for Shopify Storefront API on the APIs.io network, in the API Commons Rate Limits shape.

It captures 3 rate-limit definitions, measuring requests and checkouts_per_minute.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 3 backoff/retry policies defined and response codes documented for securityRejection and checkoutThrottled.

Tagged areas include Commerce, Ecommerce, Headless, GraphQL, and Storefront.

3 Limits
Method: generated, dated 2026-05-05.
Written by API Evangelist on 2026-05-05 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
CommerceEcommerceHeadlessGraphQLStorefrontRate Limiting

Limits

Storefront API requests shop
requests
no published rate limit
Shopify states there are no rate limits applied on the number of requests that can be made to the Storefront API.
Checkout creation throttle shop
checkouts_per_minute · minute
see docs
A throttle exists on checkouts created per minute; exceeding it returns a 200 response with a "Throttled" error.
Security rejection client
requests
see docs
Suspicious traffic patterns can be rejected with HTTP 430 Shopify Security Rejection.

Policies

No Per-Request Rate Limit
Storefront API does not enforce a published per-second or per-minute request rate ceiling; clients should still implement reasonable client-side throttling and caching.
Checkout-Specific Throttling
Checkout-creation traffic is throttled separately from product/cart reads. Retry on the next bucket window when a Throttled error is received.
Security Posture
Bot-like or abusive request patterns may be rejected with 430. Identify clients with a unique user agent and respect Retry-After when present.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/shopify-storefront-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.