Use Web Bot Auth with Shopify

Add a Shopify crawler signature so TechDash can send signed crawl requests to a storefront.

Last checked 1 September 2026

Use Web Bot Auth in Advanced Settings when you want TechDash to send Shopify's crawler signature with requests to that storefront. Shopify can then treat those requests as an authorized crawler instead of anonymous bot traffic.

The setting is off until you paste values from Shopify Admin, run Test setup, and turn it on. TechDash does not create a signing key and does not claim crawl traffic as a TechDash identity.

This does not bypass a website's rules, open private or checkout pages, or guarantee that Shopify will accept every request.

Create a signature in Shopify Admin

  1. Open Shopify Admin for the store.
  2. Go to Online Store > Preferences.
  3. In Crawler access, select Create signature.
  4. Enter a name you will recognize later, such as TechDash.
  5. Choose the Domain that matches the hostname you monitor in TechDash. example.com and www.example.com are different hosts.
  6. Choose how long the signature stays valid. Shopify allows at most three months.
  7. Select Create.
  8. Copy Signature-Input and Signature. Keep them private.

Shopify also requires a Signature-Agent value of "https://shopify.com", including the quotation marks. TechDash fills that value for you and locks the field.

Shopify cannot renew a signature. When it expires, create a new one and replace the saved values.

See Crawling your store in the Shopify Help Center.

Add the signature in TechDash

  1. Add a website, or open the website page and select Edit website.
  2. Expand Advanced Settings.
  3. Under Web Bot Auth, turn the setting On.
  4. Paste Signature-Input and Signature.
  5. Select Test setup.
  6. Review the result, then select Add website or Save changes.

After save, TechDash shows Value saved instead of the header values. Use Replace to paste a new signature, or Remove to delete the stored values.

What Test setup means

Test setup checks the pasted values locally first: both headers must be present, Signature-Agent must be Shopify's locked value, the host must match the website hostname, and the signature must not already be expired.

If that local check passes, TechDash sends a GET request to the website origin with the three headers. A successful response is shown as verified. A 403 or other unexpected status is shown as a warning and does not block you from turning the setting on. An invalid or expired signature blocks activation.

Enter the website address before you test on Add website. On Edit website, TechDash uses the saved hostname.

What the signature covers

When the setting is on and the signature is still in date, TechDash adds the three headers to in-scope crawls for that exact host:

  • Monitored page checks, including the raw HTML fetch and the browser session for the same host.
  • Site Resources fetches for robots.txt, sitemap.xml, llms.txt, and favicon.
  • Homepage icon and screenshot work on the same host.

TechDash does not send the headers to other hosts. Destination probes, Google Search Console, license or update checks, and lookups such as SSL, DNS, and domain registration stay unsigned.

A failed attempt to read the stored values leaves the request unsigned. The crawl continues without the Shopify headers.

Host matching

The signature must be created for the same hostname TechDash stores for the website. If you monitor www.example.com, create the Shopify signature for www.example.com. A signature for the apex host does not apply to www, and the reverse is also true.

Expiry

Shopify signatures expire. TechDash stores the expiry parsed from Signature-Input.

When fewer than 7 days remain, or the signature has already expired, TechDash opens a Critical incident named Shopify crawler signature expiring soon. The website overview also shows a Shopify Crawler Signature warning with an Edit website action that opens Advanced Settings.

Create a new signature in Shopify Admin and use Replace in TechDash. Turning the setting off or removing the saved values closes the incident.

Protect the saved values

Treat Signature-Input and Signature as secrets. Anyone who has them can send signed requests to that storefront until they expire.

TechDash protects the stored values in local app data before saving them. The Edit website form does not show the saved header values again. This does not replace account and disk security. Anyone with access to TechDash data under your user account may still reach locally stored secrets.

Do not put the values in screenshots, incident notes, or support emails.

Troubleshoot access

If pages still return 403, a challenge page, or incomplete content:

  1. Confirm Web Bot Auth is On and the latest test did not report an invalid or expired signature.
  2. Confirm the Shopify domain matches the TechDash hostname, including www.
  3. Confirm the signature has not expired in Shopify Admin.
  4. Confirm Signature-Agent in Shopify's documentation is still "https://shopify.com" with the quotation marks. TechDash sends that locked value.
  5. Remember that a 403 during Test setup is a warning, not proof the signature is wrong. Shopify may still challenge some routes, and checkout stays out of scope.

Changing the User agent does not replace Web Bot Auth. Use both settings only when each one is required.

Related articles