Shopsteddy

SHOPIFY STORES

Approve Shopsteddy to crawl your Shopify storefront.

Shopify gives store owners a built-in way to approve tools such as Shopsteddy. You create a crawler signature in Shopify Admin, add it to Shopsteddy, and we attach it to requests for that store.

S Shopify crawler approval

Where to find it in Shopify

Shopify currently puts crawler signatures under your Online Store preferences. The wording may move over time, so we also link to Shopify's own instructions below.

1
Open Shopify Admin

Sign in to the store you want Shopsteddy to test.

2
Online Store → Preferences

Open the Preferences page for the Online Store sales channel.

3
Find “Crawler access”

In that section, choose Create signature.

4
Name it clearly

For example: Shopsteddy or Shopsteddy storefront testing.

5
Select the domain

Choose the connected domain you want Shopsteddy to crawl. Shopify signatures are tied to that domain.

6
Choose how long it should be valid

Shopify allows an expiry of up to three months. When it expires, create a new signature rather than trying to renew the old one.

7
Create and copy the values

Add the generated values to the protected Shopify crawler approval fields in Shopsteddy.

Shopify: Crawling your store ↗

What Shopsteddy needs

Shopify's crawler approval uses three HTTP headers. Shopsteddy stores the store-specific values securely and adds them only to requests for the domain they were created for.

Signature-Input
Signature
Signature-Agent: "https://shopify.com"
You don't give us your Shopify Admin password.

This crawler approval is not an Admin API password or a general-purpose access token. It is specifically for authorised storefront crawling.

What that approval does — and doesn't do

  • It tells Shopify that the crawler requests for the selected domain have been authorised by the merchant.
  • It is intended for storefront analysis such as automated testing, accessibility checks, SEO audits and similar tools.
  • It is tied to one connected domain and expires automatically.
  • It does not grant Shopsteddy access to Shopify Admin, orders or customer records.
  • Shopify says these crawler signatures do not grant access to Shopify Checkout, which has additional security controls.

We still behave like Shopsteddy.

Shopify approval doesn't switch off our normal safeguards. We still identify ourselves as NBTBot/1.0, keep a Shopsteddy-Scan-Id, respect your crawl rules, stay within the approved site scope, apply our rate limits and back off when the store or provider tells us to.

If you remove the store from Shopsteddy or revoke its approval in Shopsteddy, we stop scheduling new scans for it. You can also manage or replace the crawler signature in Shopify Admin.

For developers

Shopify also documents Admin GraphQL objects for storefront crawler signatures, including listing signatures and an unstable mutation for generating them. We won't depend on an unstable API for the launch flow, but it gives us a route to make onboarding more automatic later.

Shopify developer reference ↗Signature generation API ↗