Shopify's leaky-bucket rate limiter (REST: 40 req burst / 2 rps refill on standard plans) has been exceeded, or a GraphQL query has consumed all cost points.
Shopify's leaky-bucket rate limiter (REST: 40 req burst / 2 rps refill on standard plans) has been exceeded, or a GraphQL query has consumed all cost points.
Read `X-Shopify-Shop-Api-Call-Limit` (REST) or the `extensions.cost` object (GraphQL), throttle client-side, and prefer bulk operations for large exports.
Shopify admin, checkout, or the Storefront/Admin GraphQL APIs.
Shopify — hosted e-commerce platform.
The client has sent too many requests in a given time window — the canonical rate-limiting and abuse-protection status code.
HTTP 429 Too Many Requests is what servers send when a client exceeds a rate limit. It's the polite way of saying "slow down" — and unlike 503 (which says "we're overloaded"), 429 specifically signals that this client has been quota'd, not that the server is in trouble. Well-behaved 429 responses include a Retry-After header telling the client exactly when to retry, plus optional rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) that let clients self-pace before they hit the limit. APIs use 429 heavily; user-facing websites use it during attacks, brute-force login attempts, or scraper abuse.
If Googlebot receives 429, it interprets it as "back off and crawl less" — and it does, sometimes for weeks. A pattern of 429s in Search Console's crawl-stats report can reduce crawl rate sitewide, which slows indexing of new and updated pages. Use 503 with Retry-After for genuine overload (Google handles this gracefully); reserve 429 for actual abuse from specific clients. Whitelisting Googlebot, Bingbot, and other major crawlers in your rate-limit rules is best practice.
LemWatch respects rate limits when monitoring your sites — we use a low default check frequency and back off on 429. If you're seeing 429s in our logs, it usually means another monitoring tool (or a scraper) is hitting the same IP we are.