Best way to run automated storefront E2E tests with Shopify bot verification?

Shopify Discussion
1

Hi everyone,

I’m trying to set up automated end-to-end (E2E) tests for a Shopify storefront. The tests are only for our own store and internal QA purposes.

The flow we want to test is:

  1. Open the storefront

  2. Add a product to the cart

  3. Go to checkout

  4. Verify pricing and discounts

However, we’re running into two issues and would appreciate any guidance.

1. Human verification challenge on Cart and Checkout

When our automated browser reaches the cart or checkout, Shopify shows a message like:

“Your connection needs to be verified before you can proceed.”

Product pages load normally, but cart requests start getting blocked, making it impossible to continue the automated test.

My questions:

  • Is there a supported way to allow trusted QA/testing traffic?

  • Can specific IP addresses be allowlisted for testing?

  • Is there a recommended way to run automated storefront and checkout tests on Shopify?

  • Are development or staging stores better suited for this type of testing?

2. Testing customer-specific pricing with passwordless accounts

Some of our tests require a logged-in customer because pricing varies by customer.

With the newer passwordless customer accounts (email one-time code), automating login has become difficult.

My questions:

  • What is the recommended way to automate tests for logged-in customer flows?

  • Is there a supported method to create or reuse authenticated customer sessions?

  • Can classic customer accounts still be used on a development store for automated QA testing?

We’re looking for a supported and sustainable solution rather than trying to bypass Shopify’s protections.

Any recommendations, best practices, or documentation would be greatly appreciated.

Thanks!

2

Hey - this is expected behavior on Shopify.

  1. The “human verification” on cart/checkout is part of Shopify’s bot protection and there’s no supported way to disable it on production stores or reliably bypass it for automation. IP allowlisting isn’t generally available unless you’re on Shopify Plus and working directly with Shopify Support for a specific setup.
  • Best practice: don’t run full E2E checkout automation on production. Use a staging/dev store for this, or limit production tests to product/cart and validate checkout logic via API or test orders.
  1. For passwordless customer accounts, UI automation is intentionally difficult (OTP flow). Shopify doesn’t provide a supported way to automate login via the UI.

  • Recommended approaches:

  • Shopify Plus: use Multipass to create authenticated sessions programmatically

  • Otherwise: use Storefront API/customer tokens or separate test setups in staging

  • Avoid automating OTP login flows - they’re not designed for E2E testing tools

  • In practice: most teams split this:

  • UI E2E (Playwright/Cypress) → product + cart flows

  • API-based validation → pricing, discounts, customer-specific rules

  • Staging store → full checkout testing

That’s the most stable and Shopify-aligned approach right now.

3

If I’m not mistaken such automation might also be against the terms and conditions of use. Might be worthwhile checking out.

4

Hello there @SatishMantri
A usual practice is to isolate E2E behavior from that of the production storefront. Use a development or staging store, and test against a custom theme or Hydrogen storefront. For cart and checkout validation, use Storefront API, or draft orders, as opposed to driving checkout UI, where bot-protection is trigered.

For customer specific pricing, use test customers with tags and login via Customer Account API access tokens rather than an email OTP flow. If you need browser based E2E, run from a secure and stable QA network IP that people can always recognize to minimize the number of verification issues.