Headless - Shopify Buy 'Checkout Url' 302 redirected back to password protected storefront

Topic summary

Headless storefront checkouts are intermittently 302-redirecting from API-provided checkout URLs back to the storefront, triggering the password page or /checkouts/co/:id/stock-problems, despite valid inventory.

Key details

  • Affects stores using Shopify Buy SDK/Storefront API. Checkout URL is rewritten to /checkouts/co/{id}, then blocked by storefront password.
  • Began recently; some stores unaffected or only affected intermittently. Mobile occurrences reported. Geo variance noted (e.g., Denmark vs. North America); some success when routing via NA VPN.
  • Incognito does not consistently help. Example stores provided; videos/screenshots show checkout landing on “information” instead of “shipping” despite prefilled fields (attachments central to reproducing behavior).

Workarounds attempted

  • Disable storefront password (widely restores checkout). Some used a “headless theme” + robots.txt.liquid to hide the shop subdomain; domain aliases may cause redirect loops.

Shopify response/status

  • Support tickets opened (e.g., 33234945). One merchant reports Shopify applied a per-store temporary fix allowing password protection to be re-enabled.
  • No confirmed global fix or timeline; behavior still reported by multiple merchants.

Current state

  • Issue ongoing, appears Shopify-side and possibly geo-related. Recommended: contact Shopify support to escalate for a temporary fix; consider disabling password protection as a stopgap.
Summarized with AI on January 8. AI used: gpt-5.

I´ve got the same issue. When will this be fixed?