Scraping Shein at Scale in 2026: A Practical Proxy & Anti-Bot Guide

Scraping Shein at Scale in 2026 is fundamentally a choice between two data paths: parse the server-rendered HTML you see in the browser, or hit Shein's internal JSON endpoints directly. Most beginners try HTML scraping, hit a 412 within 20 requests, and assume the site is unscrapable. It isn't — but the HTML path is the harder one, and understanding why will save you days of wasted effort.

This guide walks through the real anti-bot stack Shein uses, where the product data actually lives, realistic rate limits, and a working Python example using curl_cffi routed through ProxyHat. Whether you're building a price-intelligence pipeline, a fashion-market analytics dashboard, or a competitor-monitoring tool, the implementation details below apply directly.

Why Scraping Shein at Scale in 2026 Is an API-First Problem

Shein's product pages are heavy. A single PDP (product detail page) can load 3–5 MB of HTML, CSS, JavaScript bundles, and images. The price, stock, and SKU data you actually want is embedded inside that page as JSON — but extracting it from raw HTML is fragile. Shein ships product data in two on-page JSON blobs:

• productIntroData — contains the product title, description, images, attributes (color, size), and SKU list.
• gbProductDetail — contains pricing fields (retailPrice, salePrice), inventory counts per SKU, and promotional badges.

Both blobs are injected into the page as inline <script> tags during server-side rendering. You can regex-extract them, but Shein changes the surrounding JavaScript frequently — sometimes weekly — which breaks your selectors.

The better path is Shein's internal API. The site itself calls these endpoints to populate the page after initial load:

• Product detail: https://www.shein.com/api/productInfo?goods_id=XXXXXXX
• Product list (category feed): https://www.shein.com/api/category/product/list?cat_id=YYYY&page=1&page_size=40

These endpoints return clean JSON with stable field names. The trade-off: they're protected by the same anti-bot stack as the HTML pages, and they're more aggressively rate-limited because they're designed for single-user browser calls, not bulk collection. You'll need proxies regardless of which path you choose — but the API path gives you smaller payloads (50–200 KB vs. 3–5 MB), faster parsing, and more resilient field extraction.

Shein's Anti-Bot Stack: Akamai Bot Manager and the smdeviceid Token

Shein uses Akamai Bot Manager as its primary bot-detection layer. Akamai's approach is multi-layered and has evolved significantly through 2025–2026. Here's what you're up against:

The _abck Cookie and sensor_data Telemetry

When a browser first hits any Shein page, Akamai's JavaScript (served from a script tag that looks like /_bm/... or inline obfuscated code) executes and generates a cookie called _abck. This cookie is a signed token that encodes the browser's fingerprint — canvas rendering, WebGL parameters, timing data, mouse movement entropy, and dozens of other signals collected via what Akamai calls sensor_data.

The _abck cookie is not a simple value you can hardcode. It has a lifecycle:

1. On first request, Akamai issues a challenge _abck value (typically ending in ~-1~-1~-1), indicating the sensor data hasn't been validated yet.
2. The browser-side JavaScript collects telemetry and POSTs it back, producing a validated _abck value (ending in ~0~... or similar).
3. Subsequent requests with the validated cookie pass through — until Akamai rotates the challenge, which can happen every few hours or after suspicious request patterns.

If you send requests with a stale or unvalidated _abck, you'll get HTTP 412 (Precondition Failed) or a 403 with an Akamai reference page. This is the single most common failure mode for naive scrapers.

The bm_sz Cookie

Alongside _abck, Akamai sets bm_sz, a shorter-lived cookie that acts as a session correlation token. It's refreshed more frequently than _abck and must be carried consistently across requests in the same session.

The smdeviceid Device Token

Shein adds its own layer on top of Akamai: the smdeviceid cookie. This is a persistent device identifier that Shein's own backend uses for fraud detection and session tracking. It's generated by Shein's first-party JavaScript and is tied to browser fingerprinting signals similar to those Akamai collects. If smdeviceid is missing or inconsistent with the rest of your fingerprint, Shein's backend may silently flag the session even if Akamai's _abck passes.

Why Headless Chrome Alone Gets Blocked

Many developers assume that using Puppeteer or Playwright with a headless browser will solve the Akamai problem because the browser executes the sensor_data JavaScript naturally. This was partially true in 2022–2023, but Akamai has since added detection for common headless-browser signatures:

• Navigator properties: navigator.webdriver === true, missing plugins, headless user-agent strings.
• Canvas/WebGL fingerprinting: Headless Chromium renders canvas differently than real browsers, producing a fingerprint that Akamai's ML models flag.
• Behavioral signals: No mouse movement, no scroll events, instant page transitions — all red flags.
• TLS fingerprinting (JA3/JA4): Headless Chrome's TLS handshake differs subtly from desktop Chrome's, and Akamai checks this.

Tools like undetected-chromedriver or playwright-stealth patch some of these signals, but Akamai updates its detection models frequently. As of 2026, a headless browser without a real browser fingerprint and residential IP will typically survive 5–15 requests before being challenged. This is why proxy rotation and TLS fingerprint matching matter more than headless browser automation.

Where Shein's Product Data Actually Lives

If you choose the API path, you need to know the exact endpoints and parameters. Here's the field map:

Product Detail Endpoint

GET /api/productInfo?goods_id=28480657

Key fields in the response (truncated):

{
  "goods_id": "28480657",
  "goods_name": "Solid Drop Shoulder Sweater",
  "goods_thumb": "https://img.shein.com/...",
  "productIntroData": {
    "detail": [...],
    "size": [...]
  },
  "gbProductDetail": {
    "retailPrice": { "amount": "25.00", "amountWithSymbol": "$25.00" },
    "salePrice": { "amount": "12.99", "amountWithSymbol": "$12.99" },
    "unit_price": "",
    "stock": 1248,
    "sku_list": [
      { "sku_code": "SKU1", "stock": 320, "size": "S", "color": "Black" },
      { "sku_code": "SKU2", "stock": 0, "size": "M", "color": "Black" }
    ]
  }
}

The stock field at the top level is the aggregate across all SKUs. Individual SKU stock is in sku_list. A stock value of 0 means the variant is sold out but still listed — useful for out-of-stock tracking.

Category Feed Endpoint

GET /api/category/product/list?cat_id=2026&page=1&page_size=40

The cat_id maps to Shein's category taxonomy (e.g., Women's Tops, Men's Outerwear). You can discover category IDs by browsing the site and inspecting network requests in DevTools. The response returns an array of goods_id values with summary data (name, price, image) — you then call the product detail endpoint for full SKU and stock data.

Pagination

Shein paginates with page and page_size parameters. The maximum page_size is typically 40–60. A single category can have 200–2,000 products, meaning 5–50 pages per category. Shein also uses client-side infinite scroll on the HTML site, but the underlying API uses standard page-based pagination.

Rate Limits and Why Rotating Residential Proxies Are Required

Shein's rate limits are not publicly documented, but empirical testing across multiple proxy providers shows consistent patterns:

These limits assume a clean residential IP with a valid _abck cookie. Datacenter IPs are flagged much faster — often within 2–5 requests — because Akamai's IP reputation database classifies them as high-risk.

Why Geo-Targeting Matters

Shein localizes everything: currency, price, availability, and even product assortment vary by country. A product visible on shein.com (US) may not appear on shein.de (Germany), and the same goods_id can have different pricing in EUR vs. USD. If you're building a price-intelligence dataset, you need to control which locale you're scraping from.

This is where geo-targeted residential proxies become essential. With ProxyHat, you can pin each scraping session to a specific country:

http://user-country-US:pass@gate.proxyhat.com:8080
http://user-country-DE:pass@gate.proxyhat.com:8080
http://user-country-GB:pass@gate.proxyhat.com:8080

By rotating through country-targeted residential IPs, you ensure that each request is seen as coming from a real user in that market, and the prices you collect match what a local shopper would see. Check our available proxy locations for the full country list.

A Working Python Example: curl_cffi + ProxyHat

The key to bypassing Akamai's TLS fingerprinting is using a library that matches real browser TLS handshakes. curl_cffi wraps libcurl-impersonate, which reproduces Chrome's exact JA3/JA4 fingerprint. Combined with residential proxies, this is the most reliable approach as of 2026.

Here's a complete example that fetches a single product's price and stock data:

from curl_cffi import requests
import json
import time

PROXY = "http://user-country-US:pass@gate.proxyhat.com:8080"

HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/131.0.0.0 Safari/537.36",
    "Accept": "application/json, text/plain, */*",
    "Accept-Language": "en-US,en;q=0.9",
    "Referer": "https://www.shein.com/",
    "sec-ch-ua": '"Chromium";v="131", "Not_A Brand";v="24"',
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": '"Windows"',
}

def fetch_product(goods_id, session_id=None):
    username = f"user-country-US-session-{session_id}" if session_id else "user-country-US"
    proxy = f"http://{username}:pass@gate.proxyhat.com:8080"

    url = f"https://www.shein.com/api/productInfo?goods_id={goods_id}"

    for attempt in range(3):
        try:
            resp = requests.get(
                url,
                headers=HEADERS,
                proxies={"http": proxy, "https": proxy},
                impersonate="chrome131",
                timeout=15,
            )

            if resp.status_code == 412:
                print(f"412 on attempt {attempt+1} — _abck challenge, backing off")
                time.sleep(5 * (attempt + 1))
                continue

            if resp.status_code == 200:
                data = resp.json()
                detail = data.get("gbProductDetail", {})
                return {
                    "goods_id": goods_id,
                    "retailPrice": detail.get("retailPrice", {}).get("amount"),
                    "salePrice": detail.get("salePrice", {}).get("amount"),
                    "stock": detail.get("stock"),
                    "sku_count": len(detail.get("sku_list", [])),
                }

            print(f"Status {resp.status_code}, retrying...")
            time.sleep(3)

        except Exception as e:
            print(f"Error: {e}, retrying...")
            time.sleep(3)

    return None

# Example usage
result = fetch_product("28480657", session_id="shein-us-001")
print(json.dumps(result, indent=2))

Sample output (truncated):

{
  "goods_id": "28480657",
  "retailPrice": "25.00",
  "salePrice": "12.99",
  "stock": 1248,
  "sku_count": 6
}

The impersonate="chrome131" parameter is critical — it tells curl_cffi to reproduce Chrome 131's exact TLS handshake, HTTP/2 frame ordering, and header priorities. Without this, Akamai's JA3/JA4 check will flag your requests as non-browser traffic even with perfect headers.

For SOCKS5 connections, use port 1080:

socks5://user-country-US-session-shein-us-001:pass@gate.proxyhat.com:1080

Pagination, Sticky Sessions, and 412 Backoff Logic

Sticky Sessions for Currency Consistency

When scraping a full category, you'll make 20–50 sequential requests. If each request goes through a different IP, you risk hitting different localized versions of the site — prices in EUR on one request, USD on the next. This corrupts your dataset.

The solution is sticky sessions. ProxyHat lets you pin a session ID that keeps the same exit IP for the duration of your crawl:

http://user-country-US-session-shein-cat-2026:pass@gate.proxyhat.com:8080

Use one session per category crawl, then rotate to a new session for the next category. This gives you IP consistency within a crawl (so prices stay in USD) while still rotating across categories to avoid per-IP rate limits.

Pagination Loop

def scrape_category(cat_id, max_pages=50):
    all_products = []
    session_id = f"shein-cat-{cat_id}-{int(time.time())}"

    for page in range(1, max_pages + 1):
        url = f"https://www.shein.com/api/category/product/list?cat_id={cat_id}&page={page}&page_size=40"

        result = fetch_with_backoff(url, session_id)
        if not result or not result.get("products"):
            print(f"No more products at page {page}")
            break

        all_products.extend(result["products"])
        time.sleep(2)  # Respectful delay between pages

        if page % 10 == 0:
            # Rotate session every 10 pages to avoid stale _abck
            session_id = f"shein-cat-{cat_id}-{int(time.time())}-p{page}"

    return all_products

412 and _abck Refresh Logic

When you receive a 412, it means your _abck cookie has been challenged or invalidated. The correct response is:

1. Stop immediately — don't retry the same request with the same session.
2. Rotate to a new session ID (new IP via ProxyHat).
3. Wait 5–15 seconds before the first request on the new IP.
4. Make a warmup request to a Shein HTML page (not the API) to obtain a fresh _abck cookie, then carry it into subsequent API calls.

This warmup step is important: the API endpoints expect a valid _abck that was issued by a prior HTML page load. If you hit the API cold on a new IP without first loading an HTML page, Akamai may challenge immediately.

Ethics, TOS, and When to Use the Official Affiliate Feed

Before you build a large-scale Shein scraper, consider the legal and ethical boundaries:

• Public product data only. Prices, product names, images, and stock counts shown to any visitor without login are generally considered public information. Scraping this data for competitive intelligence is a common industry practice.
• No checkout or account access. Do not scrape user accounts, order history, cart data, or anything behind authentication. This crosses into CFAA territory and can expose you to legal action.
• Respect robots.txt. Check Shein's robots.txt and honor directives for paths you're scraping. Note that robots.txt is advisory, not legally binding in all jurisdictions, but ignoring it weakens any good-faith defense.
• GDPR and personal data. Product data is not personal data under GDPR. However, if you collect reviews that include user names or identifiers, you enter GDPR/CCPA scope. Stick to catalog data.
• Rate respect. Even with proxies, maintain 2–3 second delays between requests per IP. Aggressive scraping that degrades Shein's service is both unethical and counterproductive — it triggers harder anti-bot responses.

When the Official Affiliate Feed Is Better

Shein operates an affiliate program (via networks like ShareASale and LTK) that provides product feeds with pricing, images, and availability via API or CSV. If your use case is affiliate marketing, price comparison display, or any scenario where you're driving traffic to Shein, the affiliate feed is the correct path — it's authorized, stable, and doesn't require anti-bot circumvention.

Scraping is the right choice when you need data the affiliate feed doesn't provide: real-time stock levels per SKU, historical price tracking, or coverage of products not included in the affiliate catalog. For most price-intelligence and market-analytics use cases, scraping fills gaps that feeds can't.

ProxyHat Setup: Getting Started in 5 Minutes

To run the examples above, you need a ProxyHat account with residential proxy access. Here's the quick setup:

1. Sign up at ProxyHat pricing and choose a residential proxy plan.
2. Get your credentials from the dashboard at dashboard.proxyhat.com.
3. Replace user and pass in the code examples with your actual credentials.
4. Use gate.proxyhat.com:8080 for HTTP or gate.proxyhat.com:1080 for SOCKS5.
5. Append geo-targeting and session flags to the username as shown above.

For broader scraping use cases beyond Shein, see our web scraping guide and SERP tracking documentation. Full API reference is at docs.proxyhat.com.

Key Takeaways

• Prefer the API path over HTML scraping. Shein's /api/productInfo and category list endpoints return clean JSON with stable fields, and payloads are 10–50× smaller than full HTML pages.
• Akamai Bot Manager is the primary obstacle. The _abck cookie, bm_sz, and sensor_data telemetry form a multi-layered fingerprinting system. Headless browsers alone no longer bypass it reliably.
• TLS fingerprint matching is essential. Use curl_cffi with impersonate="chrome131" to match real browser JA3/JA4 signatures. Without this, Akamai flags your requests regardless of headers or proxies.
• Rotating residential proxies with geo-targeting are required. Shein localizes prices, currency, and availability by country. Use -country-US, -country-DE, etc. to control which market you're scraping.
• Use sticky sessions for consistency within a category crawl, then rotate between categories. This keeps prices in a single currency while distributing load across IPs.
• Handle 412s with session rotation and warmup requests. Don't retry on the same IP — rotate, wait, load an HTML page to get a fresh _abck, then resume API calls.
• Stay ethical. Public catalog data only, respect rate limits, and consider the official affiliate feed if your use case aligns with it.

FAQ

What is Scraping Shein at Scale in 2026?

Scraping Shein at scale in 2026 refers to the automated collection of Shein's product catalog, pricing, and stock data across thousands of SKUs using rotating residential proxies and TLS-fingerprint-matching HTTP clients. It involves bypassing Akamai Bot Manager's _abck cookie challenges and accessing Shein's internal JSON API endpoints rather than parsing server-rendered HTML.

Why does Scraping Shein at Scale in 2026 matter for proxy users?

Shein localizes prices, currency, and product availability by geographic region. A scraper without geo-targeted residential proxies will collect inconsistent data or get blocked within 20–40 requests per IP. Proxy users need country-specific residential IPs with sticky session support to maintain currency consistency across paginated category crawls and avoid Akamai's IP reputation-based blocking.

Which proxy type works best for Scraping Shein at Scale in 2026?

Residential proxies with country-level geo-targeting are the best choice for scraping Shein. Datacenter IPs are flagged by Akamai within 2–5 requests. Mobile proxies work but are slower and more expensive. Residential proxies offer the best balance of success rate, speed, and cost. Use sticky sessions (via ProxyHat's -session- flag) for multi-page crawls, and rotate sessions between categories.

How do you avoid blocks when implementing Scraping Shein at Scale in 2026?

Use three layers: (1) curl_cffi with impersonate="chrome131" to match real browser TLS fingerprints and bypass Akamai's JA3/JA4 checks; (2) rotating residential proxies with geo-targeting via ProxyHat to distribute requests across real IPs; (3) sticky sessions with warmup HTML requests to obtain valid _abck cookies before hitting API endpoints. Maintain 2–3 second delays per IP and rotate sessions on any 412 response.

Is scraping Shein legal?

Scraping publicly visible product data (prices, names, stock counts) that any visitor can see without logging in is generally legal in most jurisdictions. However, scraping behind authentication, accessing user data, or violating Shein's Terms of Service can expose you to legal risk under the CFAA or similar laws. Always consult legal counsel for your specific use case, respect robots.txt, and consider Shein's official affiliate feed as an authorized alternative.