General Target Release Guide
Target Release Guide
This guide covers how to run Target releases with Refract: how Shape and cookies work, how to set up, which settings to use, and the things you cannot change no matter what. Read it fully before your first drop.
Read the setup guide and run its starter configuration before running Target. If you do not at least make an attempt to read it, we will not be able to help you.
Target is not a game of scale
Target is not like Walmart. Plenty of people hit without running dozens of accounts.
Time and time again we have dealt with users who try to scale up and end up hitting less. More accounts and more cookies is not the goal. Running a clean, balanced setup is the goal.
Blocks are normal
Blocks are normal, on every site, and Shape on a drop has an extremely low pass rate for everyone. That is just the nature of the site. Experienced botters and new botters have very different ideas of what a "normal" amount of blocks looks like.
Experienced users will tell you they can get 80% blocks on a restock and be completely fine with it, because they know they will hit eventually. Some newer users think you are supposed to see all green all the time. That is not how it works.
Unless you are getting blocked close to 100% of the time and nothing is moving at all, just have patience. When you check the stats of someone who is sure their setup is bad, the stats almost always look the same as everyone else's. The perception of what is "normal" is the thing that is off.
Let the site security come down. Let your proxies and device cool down. Have patience.
Shape, explained
This is the most important section. Read it slowly. Everything we know about Shape lives in these guides. Opening a ticket will not get you more than what is written here, because we have nothing more.
What Shape and Target cookies are
Some requests to Target (add to cart and login) are protected by Shape, which is Target's antibot system. To pass that protection, the request has to present a valid cookie. Think of the cookie as a test that has to score 90% or higher to pass.
The extension (or the in-bot harvester) generates these cookies and saves them for each task to use. The harvester never sends the actual add-to-cart or login request itself. It intercepts that request and saves the cookie for later.
Each protected request consumes one cookie. Every add-to-cart attempt makes your cookie count go down.
Shape is a score, not a single setting
This is the part people miss. Shape does not pass or fail you on one thing. It scores the whole picture and rejects cookies based on several factors at once:
Proxy trust score
Device trust score
Browser
How many cookies you are generating
The product's current security level
Each product has its own security level based on how much traffic it is getting. The more a product gets spammed, the higher its security climbs. Later in the day, after many small restocks where people have hammered a product, security will be higher for everyone.
Because Shape is a combined score, there is no single fix and no one-size-fits-all approach. A proxy swap alone will not save a tired device, and a fresh device will not save bad proxies. What fixed someone else's blocks may do nothing for yours. Treat your proxies, device, browser, and cookie count as one setup that has to be healthy together.
Why your cookies get depleted
Since each add-to-cart attempt uses a cookie, each task uses at least 1 cookie when a product restocks.
If an attempt gets blocked, it shows "Shape Block," then tries again and consumes another cookie.
In practice: if you have 20 tasks and 40 cookies, a restock uses at least 20 cookies. If every task gets blocked on the first attempt, it tries again and uses another 20, leaving you at 0.
This is why generating more and more cookies backfires. The more cookies you push, the more you raise your own risk of getting flagged and Shape blocked. Aim for about 3 cookies per running task in the bank, not a giant pile.
How many Shape browsers do you need?
People often ask for a browser-to-task ratio, or exactly how many browsers to run. There is no simple answer. It takes as many browsers as it takes to generate the cookies you need.
The target is the same as always: about 3 cookies per running task. Scale your browser count up or down to hit that number, and find the sweet spot for your machine. As a rough starting point, for around 90-120 cookies you will probably need about 6 browsers. How fast each browser generates depends on your machine, your proxies, and the product's current security level, so treat that as a guide, not a fixed rule.
How to pass Shape blocks
Use the right device, and run local
Device type matters a lot for your Shape score. Best to worst for Target:
Mac and Mac mini servers (best for Shape)
Local Windows
Avoid Windows servers for Target if you can at all. They are much harder on Shape. In general, servers all look very similar to Shape and tend to get detected faster, so a local machine beats a server of the same type.
Let your setup rest instead of buying more
Do not run out and buy 300 new proxies just because you stopped hitting later in the day after a bunch of tiny restocks. More than likely your device and proxies just need a rest, and the product's security level will come down over time as the restocks slow down.
For Target Shape, a Mac or Mac mini server is best, then local Windows. Do not use a Windows server for Target if you can avoid it. It is much harder on Shape than the other two.
The setup that has been working
For most users, especially newer users, this is the setup that has worked best for the people we have helped:
10 tasks, with 10 unique accounts total (one task per account)
Running multi-SKU
Running on a local PC
Running 2 product cookie harvesters without proxies: 1 on Chrome and 1 on Brave
Experimenting with lower monitor and task delays to find what works for your machine
This setup will not work on a server. Run it local. Shape blocks should be far less this way, but they may still happen. If they are very heavy, it is likely your IP, device, or browser. Results will always vary.
Shape is a balancing act. Too many tasks forces you to generate an excessive number of cookies, which leads to tons of blocks. Remember the factors: proxies, device, browser, and how many cookies are being generated.
Don't get discouraged
Shape blocks happen to everyone, and they are far more common after the first wave because everyone is spamming at once. Target sees traffic jump 100x or more right after a drop, so they crank security up immediately. On a drop, Shape's pass rate is extremely low across the board; that is the nature of the site. Seeing Shape block does not mean your setup is broken.
Where the step-by-step setup lives
The two guides below walk through actually setting up cookie generation. The in-bot harvester has been passing Shape better than the extension, so focus there if you can. Both remain viable and you can run both at the same time.
On proxies: residential on tasks, and especially on harvesters. Resis use data, but they have been passing Shape much better. Keep ISPs on the monitor.
https://help.refractbot.com/modules/target/extension-shape-generationhttps://help.refractbot.com/modules/target/in-bot-shape-generationMulti-SKU / Multi-Input
You can run the same accounts more than once for Target.
Multi-SKU is still preferred. Keep the cookie cost in mind: for every task group you duplicate, you need double the cookies you needed before, since each running task should have 3 cookies. In numbers: 10 tasks in 1 group need 30 cookies, the same 10 accounts duplicated into a second group are 20 running tasks needing 60, and a third group makes it 90. Multi-SKU covers the same products at the original cookie cost.
The more cookies you generate, the higher the chance you get flagged and Shape blocked. This is the trade-off behind scaling up, and it ties straight back to Shape being a score. Generate what you need, not more.
Recommended settings
These are the settings that have worked best. Start here.
Hype Product
Set this to ON / ENABLED. Hype Product must be enabled for any Target drop that requires Shape cookies, which is all the high-demand drops (cards, consoles, and similar).
High Stock & Pre-Orders Only
Optional. With this on, the bot only goes for high-stock items (10+ in the stock count) and pre-orders. Leave it off by default, including for a normal potential restock.
Loop Checkouts
Optional, and run at your own risk. It may increase flags and cancels.
Loop Checkouts is also used if you are running multi-SKU and you hit. With this on, tasks do not stop at "Success." They keep looping to that same product (as multi-SKU always does) until that product is out of stock, then move to the next in-stock product.
Rate Limit (High Demand)
Do not open a ticket about Rate Limit (High Demand). There is nothing we or you can do about it. This is Target rate limiting everyone's checkouts during high-traffic drops. It is not a proxy, account, or bot issue. It is a site-wide traffic throttle.
There is still a lot of confusion around Target rate limits. That makes sense, because the current Target experience is not intuitive for normal manual users either. Their system has made hype drops frustrating across the board.
A regular "Rate Limit" message usually indicates a proxy or bot-related block. Based on our analysis, the bot-related rate limits that were happening a few weeks ago have been resolved.
"Rate Limit (High Demand)" is different. This appears to be Target limiting how many requests can reach their backend during high-traffic drops. If you test manually and inspect the requests, you will see the same behavior: during hype drops, clicking Add to Cart often does nothing, and you have to click it repeatedly. The bot runs into the same issue. The response is a 429 and usually includes one of these errors:
FAST_SELLING_ITEM_RATE_LIMIT_EXCEPTIONERR_A2C_TCIN_RATE_LIMITED
You may also see this on-site as a "High-demand item in your cart" popup ("A popular item in your cart is causing a delay. We're managing high traffic right now. Please try again."). The bot just has to keep submitting the order and let it ride.
This is all the information we currently have. We do not know what percentage of requests Target allows through during this high-demand rate limit, but based on testing it is most likely intended to reduce traffic hitting their backend. That may work for Target, but it creates a poor experience for manual users and bots alike, especially since these drops often happen at 3 AM.
"Rate Limit" and "Rate Limit (High Demand)" are not the same thing. Plain "Rate Limit" has been heavily improved and fixed on drop. "Rate Limit (High Demand)" is different and you will still see it on any Target restock. Based on all current testing, this is a site-wide Target rate limit, not an issue with your setup or the bot. We are actively testing to see if there is anything we can do to mitigate it, but right now all signs point to this being controlled on Target's side.
Target Profiles & Cancellations
The common cancellation states are Item Demand, Fraud Deny (Consult OVT), and Quantity Limit.
Item Demand and Fraud Deny (Consult OVT): although the statuses differ, they can be addressed the same way. In most cases, these cancellations are associated with your Target profile, account, proxy, and/or payment method rather than a setting in Refract.
Quantity Limit: Target enforces a per-customer purchase limit on hype products and cancels orders beyond it. Target decides what counts as the same customer, and it links orders by more than the account alone: shipping address, payment method, and other identity signals can group your orders together. If several of your checkouts for the same product share too much information, expect the extras to get cancelled. The prevention is entirely on your end: keep checkouts per product within Target's limit per identity, and vary the identities across your setup. How far to vary them is exactly the profile territory your cook group covers.
The Refract team can review our logs for signs of a Refract-side issue, but all of these cancellations are caused by Target-side order checks that we cannot diagnose or resolve. These outcomes vary heavily by user, and there is no single Refract-side change or guaranteed fix that works for everyone.
Start with your cook group. Users often compare notes in Discord communities and other cook groups to learn which strategies are currently helping reduce cancellations. Aside from trial and error, these communities are the best source of up-to-date information, since effective methods are often shared privately. There is no foolproof solution we can recommend, but this is the best place to gather ideas and begin testing different approaches.
Not in a cook group yet? Ask around in the community for an active one to join, and start there. There are many options.
Important notes
Shape security spikes during drops. That is just how it is. Millions of tasks are spamming add-to-cart, and after the first wave it will be harder to ATC.
Defaults exist for a reason. Across both the bot and the extension, the defaults are what has worked best. You are free to change delays and extension settings to test different things. That is your call. But asking us what to change them to will not help, because we do not have suggestions. If we had better values, they would already be the defaults.
Required version
Make sure you are on the latest extension version (currently 3.1.11). Older versions will not behave the same.
Last updated
Was this helpful?