The ChatGPT shopping user agents: every AI crawler your store should allow

The user agents ChatGPT actually uses

There is no single "ChatGPT shopping user agent." When ChatGPT recommends products it draws on an index built by one crawler, live page fetches made by a second, and, separately, whatever the underlying model learned from a third during training. OpenAI documents all of them, with per-bot IP ranges, on its bots page. The token in the user agent string is the stable identifier; version suffixes change without notice.

The one merchants get wrong most often is the difference between OAI-SearchBot and GPTBot. Blocking GPTBot is a defensible intellectual-property decision that does not remove you from ChatGPT search. Blocking OAI-SearchBot is self-inflicted invisibility: OpenAI is explicit that opted-out sites are not shown in ChatGPT search answers. And the training decision is bigger than it looks, because ChatGPT does not search the web on most queries: Semrush measured live web search on just 34.5% of queries in February 2026. The rest of the time, the answer about your brand comes from what the model already believes.

How to find and verify them in your server logs

Each OpenAI crawler announces itself with its token plus a reference URL inside an otherwise ordinary browser-style user agent string. Search your access logs for the tokens themselves: OAI-SearchBot, ChatGPT-User, and GPTBot. Hits from OAI-SearchBot mean ChatGPT search can see you; hits from ChatGPT-User mean real shoppers are asking about you right now, and those fetches never fire client-side analytics, so your logs are the only place they show up at all.

Do not trust the string alone. Any scraper can claim to be OAI-SearchBot, and copycat traffic is common enough that OpenAI publishes the authoritative IP ranges for every bot as JSON: searchbot.json, chatgpt-user.json, and gptbot.json. A hit is genuine only if its source IP falls inside the matching list. Perplexity publishes the same thing for PerplexityBot and Perplexity-User.

• Grep your access logs for OAI-SearchBot, ChatGPT-User, and GPTBot and note which pages each one reads.
• Validate suspicious hits against the published IP-range JSON before whitelisting or blocking anything.
• Watch which URLs ChatGPT-User fetches: each one is a live shopper question, which makes it the closest thing to seeing demand inside ChatGPT.
• Check your robots.txt, CDN, and bot-protection settings before concluding a crawler never visits: silence in the logs usually means a block, not disinterest.

The robots.txt that keeps a store visible

The safe default for a store that wants AI traffic is three lines of intent: allow OAI-SearchBot everywhere, leave ChatGPT-User alone (OpenAI treats user-initiated fetches as outside robots.txt anyway, and Perplexity says the same of Perplexity-User), and make a deliberate choice about GPTBot. If you sell products, being in the training data is usually free brand distribution; if your catalog content is your moat, blocking it is rational. What is never rational is blocking everything by reflex and wondering why ChatGPT recommends your competitor.

• Allow the search crawlers: User-agent: OAI-SearchBot followed by Allow: /, and the same for PerplexityBot and Claude-SearchBot.
• Decide on the training crawlers separately: GPTBot, ClaudeBot, and Google's Google-Extended token only govern model training (and, for Google-Extended, Gemini grounding), not search visibility.
• Do not bother blocking the user-fetch agents: ChatGPT-User, Perplexity-User, and Claude-User act on a human's direct request, and both OpenAI and Perplexity document that these fetches do not follow robots.txt rules.

Google is the special case: there is no opt-in token for AI answers. Per Google's documentation, appearing in AI Overviews and AI Mode requires being indexed and snippet-eligible in normal Search, so regular Googlebot access covers it, and Google-Extended controls only Gemini training and grounding without affecting Search rankings.

Every assistant's crawlers, side by side

The same three-way split (search crawler, user-fetch agent, training crawler) repeats across every major assistant, and each one publishes its own documentation. ChatGPT matters most in practice because it sends three quarters of all AI referral traffic, but the marginal cost of allowing the rest is one robots.txt line each. The engine-by-engine traffic numbers live in AI traffic sources compared.

Why stores block AI crawlers without knowing it

Most AI-crawler blocks are not decisions, they are defaults. On July 1, 2025, Cloudflare began blocking known AI crawlers by default for new domains, reasoning that crawl traffic had decoupled from referral value (Cloudflare's own measurement put ClaudeBot at roughly 71,000 crawl requests per referral click). That policy makes sense for publishers who sell content. For a store, the same default quietly removes you from the shopping answers your buyers are reading. If your site sits behind Cloudflare or any WAF with a bot-management list, audit what it blocks before assuming your robots.txt is the whole story.

The second silent block is architectural: a page that only exists after JavaScript runs. None of the crawlers in this guide execute JavaScript reliably, so a single-page app that serves an empty HTML shell is invisible even with a perfectly welcoming robots.txt. Getting the crawlers in the door is step one of agentic commerce; serving them something readable when they arrive is the other half, and AI storefront setup covers how.

Where the user agents fit in ChatGPT shopping

Shopping answers are assembled from more than the crawl: OpenAI combines the OAI-SearchBot index with structured merchant product feeds and third-party corroboration like reviews and roundups. The crawler plumbing on this page is the entry ticket; ChatGPT product discovery covers the rest of the pipeline, including the Agentic Commerce Protocol feed spec and how ranking works once you are in. And the agents doing the reading are worth understanding in their own right: how AI shopping agents work covers how they discover, evaluate, and recommend products.