How Shopify Checkout Validation Works (and How Apps Use It to Block Orders)

Shopify checkout validation is a Shopify Function, from the Cart and Checkout Validation API, that an app installs on your store. Shopify runs it on its own servers whenever a cart or checkout changes. If the Function returns an error, checkout shows the message and the buyer can't complete the order until they fix the problem. It runs on the normal checkout, express buttons like Shop Pay and Apple Pay, headless checkouts and draft orders, on any Shopify plan when it comes from a public app. It doesn't run on POS, subscription renewals, order edits or orders created through the API. It can block an order, but it can't change the cart or reserve stock.

Last verified: October 8, 2026, against Shopify's developer documentation and help center. Sources are at the end.

Disclosure: OrderRules is a checkout validation app. This guide explains the Shopify platform first, then how we use it.

What a validation Function is

Shopify Functions let apps add their own logic to Shopify's backend. Each Function API covers one job: discounts, delivery options, payment methods, and so on. Validation is the one that decides whether a cart can check out.

Here's how it works:

1. An app ships the Function. It's compiled to WebAssembly and deployed with the app. You install the app; you don't touch code.
2. Shopify runs it, not your theme. The Function runs inside Shopify's infrastructure, not in the shopper's browser. Turning off JavaScript or editing the page doesn't skip it.
3. It reads an input and returns errors. Shopify passes in the cart and related data. The Function returns a list of errors, each with a message and a target (the whole cart, or a specific field).
4. Checkout shows the message. Empty list: checkout continues. Any errors: Shopify shows the messages and blocks completion until the buyer changes something.

Shopify runs the Function at several points of the buyer journey: cart interactions, checkout interactions, and checkout completion. A Function can check which step it's on and decide to only block at checkout, so adding to cart never fails.

Shopify keeps Functions small and fast. Each run has strict limits on instructions and input size, so the logic has to be simple and the data compact.

Here's a simplified example in JavaScript of the current target, cart.validations.generate.run. It's illustrative, not OrderRules' code:

// Simplified example, not production code.
// Input comes from a GraphQL input query (cart lines, buyer identity, metafields).
export function cartValidationsGenerateRun(input) {
  const limits = input.shop.limits?.jsonValue ?? {}; // written by the app ahead of time
  const errors = [];

  for (const line of input.cart.lines) {
    const productId = line.merchandise.product?.id;
    const remaining = limits[productId];
    if (remaining !== undefined && line.quantity > remaining) {
      errors.push({
        message: `Only ${remaining} left for today. Lower the quantity to continue.`,
        target: "$.cart",
      });
    }
  }

  return { operations: [{ validationAdd: { errors } }] };
}

Notice what's missing: no database query, no API call, no "count orders today". The Function only sees what's in its input. That shapes everything below.

Where it runs and where it doesn't

Shopify documents which surfaces run validation Functions. The table follows the Cart and Checkout Validation API reference.

So "cannot be bypassed" isn't accurate. A shopper can't skip validation from the online store or an express button. But an order from POS, a renewal, an edit or the API never goes through it. If you rely on a limit, check which of those channels your store uses.

What a Function can see

A Function declares an input query, written in GraphQL, and Shopify fills it in on each run. Useful fields include:

• Cart lines: quantity, variant, product, weight, line attributes.
• Buyer identity: whether the buyer is logged in, and for customers, fields like order count and amount spent.
• Metafields: on the shop, products, variants and customers.
• Cart attributes: for example, a delivery date chosen on the cart page.
• The buyer journey step: cart interaction, checkout interaction or checkout completion.

What it can't do on a public app: call the network. It can't ask the app's server "how many orders today?" during checkout. Instead, the app does the counting elsewhere. It listens to Shopify's order notifications, updates its totals, and writes them to metafields. The Function reads those metafields on the next run.

That's why counts in a Function are snapshots. They're as fresh as the last metafield write, not live.

What it can and can't do

It can block with a message. That's its whole output. Messages can target the whole cart or a specific checkout field, and an app can let you write your own wording.

It can't change quantities. A validation Function can't lower a quantity, remove a line or change a price. Old Shopify Scripts could quietly edit the cart; validation can't. The buyer reads the message and fixes the cart. Other Function APIs, like Cart Transform or discounts, handle cart changes, and they don't block checkout.

It can't reserve stock or slots. The Function reads a snapshot and says yes or no. It doesn't hold anything. If two buyers check out for the last unit, or the last place in a delivery slot, at nearly the same moment, both can read "1 left" and both can pass. Validation makes limits reliable in normal traffic. It doesn't guarantee you never go over.

Up to 25 validation Functions per store. Shopify caps how many validation Functions can be active at once. Several apps can each add one, and they all run; any one of them returning an error blocks checkout.

Plans

• Public App Store apps with Functions work on every Shopify plan. You don't need Plus to install a validation app.
• Custom apps with Functions need Shopify Plus. That's for stores building their own private Function.
• Shopify Scripts are gone. Scripts stopped running on June 30, 2026. Many quantity limits used to live in line item scripts. If yours did, see replacing Shopify Scripts with Functions for quantity and checkout rules.

Theme JavaScript vs validation

Many limit tools run in the theme: they hide a button, cap a quantity input or show a warning on the cart page. That's useful for showing limits early. It isn't enforcement.

Neither covers POS or renewals. The best setup uses both: storefront messaging so shoppers see limits early, and a validation Function as the hard stop at checkout.

The same applies to delivery dates. A date picker greys out full or closed days in the browser, but express buttons and direct checkout links skip the page the calendar sits on. Only a validation Function re-checks the chosen date at checkout. See how the Shopify delivery date picker apps compare on checkout validation.

How OrderRules uses it

OrderRules installs one validation Function. You set rules in the app; the app keeps the counts and writes them to metafields; the Function reads them at checkout and blocks orders that break a rule. It checks:

• Store hours and holidays: closes checkout outside your hours.
• Order caps: daily store-wide caps, plus weekly and monthly caps on paid plans.
• Product, variant and collection caps: shared totals across all shoppers.
• Minimum order quantity and step quantity: per product or variant, per order.
• Per-customer limits: orders, units, spend or weight per period, for logged-in customers.
• Delivery dates and pickup slots on the Advanced plan: cutoffs, blackout dates and per-slot caps.

The message for each rule type is editable in Settings. Rules are checked on every surface in the table above where validation runs. POS orders and renewals aren't blocked, but they still count toward your limits. Counts are snapshots, so two near-simultaneous checkouts for the last place can both pass.

Checkout enforcement is included on every plan, including the free Starter plan. Full details: where OrderRules rules are checked: compatibility and limitations.

Related Reading

• How to set order limits on Shopify
• Prevent overselling: strategies for capacity-constrained stores
• Per-customer order limits: a guide
• Dynamic storefront messaging
• Best Shopify delivery date picker apps, compared on checkout validation
• Shopify delivery date validation: the checks and the messages customers see
• Shopify's native order limits vs apps (2026)
• Where OrderRules rules are checked: compatibility & limitations
• Replacing Shopify Scripts with Functions for quantity and checkout rules

Sources

• Shopify.dev: Cart and Checkout Validation Function API (targets, supported and unsupported surfaces, per-store limit)
• Shopify.dev: Build a cart and checkout validation Function
• Shopify.dev: Shopify Functions (plan availability for public and custom apps)
• Shopify.dev changelog: Shopify Scripts will be deprecated on June 30, 2026
• Shopify Help Center: Transitioning from Scripts to Functions

Try It on Your Store

Install OrderRules from the Shopify App Store. Checkout validation is included on every plan, and paid plans have a 14-day free trial.