Blocking a Shopify checkout that breaks your rules, with Cart and Checkout Validation

Some orders should never be placed: more units than a flash sale allows, a business order below its minimum, a purchase order number in the wrong format. Fixing them after the fact means cancellations and emails. Shopify’s Cart and Checkout Validation Function stops them before the order exists.

What it does

A validation function receives the cart and checkout data it asks for through its input query and returns errors when a rule isn’t met. Shopify runs it on its own servers, and it can block checkout progress, so a customer can’t get around it in the browser.

It covers express checkouts too, such as Shop Pay, PayPal, Google Pay and Apple Pay. And the errors aren’t limited to checkout: they are also shown in themes that use the cart template, and returned on the Storefront API’s Cart object, so a custom storefront can show them as well.

Rules it is built for

Shopify lists these use cases for the API:

• Quantity limits, for example in a flash sale
• B2B product minimums, maximums and multiples
• B2B location order minimums, maximums or credit limits
• Validating purchase order numbers for B2B customers
• Billing address restrictions
• Requiring a customer membership or token at checkout, or checking a customer’s age or ID

Each error can target a specific checkout field, so the message appears where the customer can fix it, or the cart as a whole. Since API version 2026-04, validations can also target the billing address fields and the purchase order number.

Limits to plan for

• Plan. Stores on any plan can use App Store apps that contain Functions. A custom app that contains Functions runs only on Shopify Plus stores.
• Count. A store can activate at most 25 validation functions.
• Data. The function sees only what its input query requests. It can’t read the clock or generate random values; thresholds usually come from metafields.
• External data. Network access for validation functions is limited to Shopify for enterprises with custom apps, and Shopify has to enable it. Most rules should be built on data already in Shopify.

When validation is the wrong tool

Validation refuses an order; it doesn’t change it. If the goal is to discount, hide a delivery or payment option, or change how cart lines are grouped, other Function APIs fit better: see where each Shopify Script’s logic goes now.