About this bot

Requests signed with the key published here come from a small research tool that reads public store pages. It sends one of these user agents:

• KeptuShopifyCheck/0.1 checks whether a store runs on Shopify: robots.txt, the homepage and /products.json?limit=1, and the site icon its homepage names.
• KeptuResearch/0.1 reads a store's public product list, /products.json.

How it behaves

• It reads robots.txt first and obeys it.
• One request every 3 seconds at most, and at most one pass per store per day.
• It stops for the day on 401, 403, 429, 430 or any challenge, and honours Retry-After. It never solves a CAPTCHA, uses a proxy or rotates IP addresses.
• It never logs in and never touches a cart, checkout or account.
• It keeps store facts only: titles, prices, availability, dates and image addresses. The one file it keeps is the small site icon, once per store.

How to opt out

Add this to your robots.txt. The tool reads it on every run, so the change applies from its next visit.

User-agent: KeptuShopifyCheck
Disallow: /

User-agent: KeptuResearch
Disallow: /

To ask a question or have a store excluded without editing robots.txt, write to {bot_contact}.

Checking a request

Each request carries Signature, Signature-Input and Signature-Agent headers (Web Bot Auth: RFC 9421 HTTP Message Signatures, Ed25519). The public key is at /.well-known/http-message-signatures-directory.