StockX & Sneaker Resale Price Scraping at Scale

What goes wrong when this scraper fails

Resale valuation, portfolio pricing, and sneaker market research all depend on a handful of public numbers - StockX's lowest ask, highest bid, and last-sale price; GOAT and Flight Club listing prices; and the release date, retail price, and stock status published on retailer drop pages like Nike SNKRS, Foot Locker, and END. None of these vendors publish a documented public pricing API for analytics, so the data has to come from the same pages and internal JSON endpoints a browser hits. Doing that reliably means surviving aggressive, actively-maintained anti-bot systems and geo-gating - at request volumes and burst rates that peak violently around scheduled drops.

Why this failure mode happens

StockX runs PerimeterX (HUMAN) bot management; Nike, Foot Locker, and END-class retailers run Akamai Bot Manager with sensor-data telemetry; GOAT and others layer Cloudflare and custom challenges. These systems build a per-session trust score from your TLS/JA3 fingerprint, HTTP/2 frame ordering, header order and completeness, IP reputation (datacenter ASNs are pre-scored hostile), and request velocity - then serve you real JSON, a JavaScript challenge, or a hard block accordingly. Because the price data is monetized and the drop calendar is a prime target for checkout bots, these sites invest heavily in keeping all automation out and update their signatures frequently, which is why a scraper that read public prices fine last month silently rots.

Challenges that make this hard to automate

TLS/JA3 and HTTP/2 fingerprinting: PerimeterX and Akamai read the shape of your TLS ClientHello and h2 SETTINGS frames before any HTML, so a stock Python-requests or urllib client is identified as non-browser regardless of headers.
Geo-gated pricing and availability: StockX localizes currency, ask/bid, and shipping by IP, and retailer SNKRS calendars differ per country - a single-region proxy pool gives you a distorted, incomplete market view.
Drop-time traffic spikes: the exact windows you most want data (a hyped release going live) are when the origin is under 100x load and its bot defenses tighten, turning steady scraping into a wall of 429s and interstitials.
Soft blocks that return HTTP 200: challenge pages, empty product grids, and null price fields come back as 200 OK, so naive success checks poison your dataset with phantom sold-out or price-zero records.
IP reputation decay: read StockX from a narrow set of exits and those IPs get reputation-flagged fleet-wide, so throughput quietly collapses even though nothing in your code changed.

Approaches that usually fail

Datacenter proxies from a single provider - cheap and fast, but their ASNs are pre-flagged by Akamai/PerimeterX and get challenged or blocked within minutes on StockX and SNKRS.
Headless Chrome/Puppeteer with no proxy rotation - solves the JS challenge but runs every request from one IP, so velocity-based scoring rate-limits or bans the box in a single drop window.
Third-party 'sneaker API' aggregators - convenient until their upstream access breaks during a drop or their data goes stale, and you have no visibility into freshness or geographic coverage.
Hand-rolled residential proxy lists scraped from free sources - unreliable, often already burned, frequently logging your traffic, and impossible to target by country for geo-gated pricing.

When residential proxies fix this — and when they cannot

Rotating residential proxies give each request a real consumer IP from a clean ASN, which is the single biggest lever against reputation-based scoring - Akamai and PerimeterX treat a residential Comcast or BT exit very differently from a Hetzner or AWS one. Rotating per request spreads velocity across thousands of exits so no single IP accumulates a rate-limit signature during a drop-time burst, while country-targeted exits let you read StockX's localized ask/bid and each region's SNKRS calendar as a local user would. Proxies do not by themselves defeat TLS fingerprinting or JS challenges - you still need a browser-grade client - but they remove the IP and velocity signals that otherwise get you challenged before your fingerprint even matters.

How Aethyn residential proxies help here

Aethyn's Elite residential tier is built for exactly this profile: high-reputation consumer exits across the countries where sneaker pricing is geo-gated, with per-request rotation as the default so drop-time bursts never stack on one IP. You target a country (and city where retailer inventory is regional) in the proxy username, and can pin a short sticky session when a multi-step page flow must stay on one exit. The result is that IP reputation and velocity stop being the thing that flags you, letting you focus on presenting a browser-grade TLS and header fingerprint.

Elite residential pool on clean consumer ASNs that Akamai/PerimeterX score as human, sharply reducing challenge rates versus datacenter IPs on StockX and SNKRS.
Per-request rotation by default (port 5499) so a 100x drop-time spike is spread across thousands of exits with no per-IP velocity signature.
Country and city targeting in the username - -country-us, -country-gb, -country-jp, -city-chicago - to read geo-gated resale prices and regional release calendars accurately.
Short-lived sticky sessions (-session-TOKEN-lifetime-N, up to 30 min) for multi-request page flows that must land on one exit, then rotate away.
Massive concurrent capacity to absorb the spiky, bursty request pattern around scheduled drops without queueing or throttling on the proxy side.
One consistent username-encoded URL format so geo and rotation logic lives in config, not scattered across your codebase.

How to implement this with residential proxies

1
Route requests through country-targeted Elite exits
Start by encoding geo and rotation into the proxy username so every request leaves from a residential IP in the country whose pricing you want. StockX localizes ask/bid and currency by IP, so read US pricing from -country-us and GBP pricing from -country-gb rather than converting after the fact. Leave off any session token so the Elite tier rotates on every request - that is what keeps drop-time velocity off any single exit.
python
```
import requests

# Elite tier -> port 5499. Per-request rotation is the default (no session token).
PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"
proxies = {"http": PROXY, "https": PROXY}

r = requests.get("https://api.ipify.org?format=json", proxies=proxies, timeout=20)
print("exit IP:", r.json()["ip"])  # different IP every call
```
Field note: Verify the exit country before you trust the price. Hit an IP-geo endpoint through the proxy once at startup and assert the country matches your target - a mislabeled exit silently mixes GBP asks into your USD dataset and no error is ever raised.
2
Present a browser-grade TLS and header fingerprint
Rotating IPs removes the reputation signal, but PerimeterX and Akamai still read your TLS ClientHello. Stock requests advertises a Python TLS signature that no Chrome ever sends, so pair the proxy with a client that mimics a real browser's JA3 - curl_cffi with impersonate is the lightest option. Send a complete, ordered header set: a bare User-Agent with no Accept-Language or Sec-CH-UA is a classic bot tell.
python
```
from curl_cffi import requests as cffi

PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"

headers = {
    "Accept": "application/json",
    "Accept-Language": "en-US,en;q=0.9",
    "Sec-CH-UA": '"Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99"',
    "Sec-CH-UA-Mobile": "?0",
    "Sec-CH-UA-Platform": '"macOS"',
}

# impersonate a real Chrome TLS/JA3 fingerprint end-to-end
r = cffi.get(
    "https://stockx.com/api/products/example-slug",
    headers=headers,
    proxies={"https": PROXY},
    impersonate="chrome124",
    timeout=25,
)
print(r.status_code)
```
Field note: Keep the impersonated browser version and your Sec-CH-UA header in lockstep. If you impersonate chrome124 but send a Sec-CH-UA claiming v=120, the mismatch between the TLS-implied version and the header-claimed version is itself a flag Akamai scores.
3
Parse the product JSON and defensively validate prices
StockX product pages hydrate from an internal JSON payload carrying lowestAsk, highestBid, and last-sale market data - read that, not the rendered HTML, so a layout change does not break you. The critical discipline is validation: a 200 response with a null lowestAsk or an empty market object is a soft block or an unlisted variant, never a real zero. Treat missing or zero prices as a failed fetch to retry on a fresh exit, not a datapoint.
python
```
def extract_market(payload: dict) -> dict:
    product = payload.get("Product") or payload.get("product") or {}
    market = product.get("market") or {}
    ask = market.get("lowestAsk")
    bid = market.get("highestBid")
    last = market.get("lastSale")

    # A 200 with null/zero pricing is a soft block, not a free sneaker.
    if not ask or ask <= 0:
        raise ValueError("empty market data - likely challenge/soft block, retry on new exit")

    return {
        "sku": product.get("styleId"),
        "title": product.get("title"),
        "lowest_ask": ask,
        "highest_bid": bid,
        "last_sale": last,
        "spread": (ask - bid) if (ask and bid) else None,
    }
```
Field note: Log the raw response length and status alongside every parse failure. Soft blocks cluster - if your empty-market rate jumps from 1% to 30% in a five-minute window, a signature changed or a pool went hot, and you want that visible on a dashboard, not buried.

Scrape retailer drop calendars and normalize release dates

Release calendars on SNKRS, END, and Foot Locker publish the launch datetime, retail price, and mechanics (FCFS vs raffle) in embedded JSON or structured markup. Pull the calendar per region - a UK SNKRS calendar differs from the US one - and normalize every release datetime to UTC so your monitoring schedule fires correctly across timezones. Use city targeting where a retailer gates inventory regionally.

python

from curl_cffi import requests as cffi
from datetime import datetime, timezone

# City targeting for regionally-gated retailer inventory.
PROXY = "http://aethyn-XXXXX-country-us-city-chicago:PASSWORD@proxy.aethyn.io:5499"

resp = cffi.get(
    "https://www.example-retailer.com/api/launch-calendar",
    proxies={"https": PROXY},
    impersonate="chrome124",
    timeout=25,
).json()

releases = []
for item in resp.get("entries", []):
    raw = item.get("launchTime")  # ISO8601 with offset
    dt_utc = datetime.fromisoformat(raw).astimezone(timezone.utc)
    releases.append({
        "name": item.get("title"),
        "sku": item.get("styleCode"),
        "retail": item.get("price"),
        "launch_utc": dt_utc.isoformat(),
        "mechanic": item.get("launchType"),  # e.g. FCFS / DRAW
    })

Field note: Snapshot the calendar on a schedule and diff it, do not just overwrite. Retailers quietly change launch times and pull releases; the diff between yesterday's and today's calendar is itself a valuable market signal that a single-snapshot pipeline throws away.

5
Handle JS challenges and 429s with backoff and rotation
When a request comes back as a PerimeterX interstitial (often a 403 with a px-captcha body) or a 429, the wrong move is to retry the same URL immediately - that confirms you are automated. Detect the block class, rotate to a fresh exit (automatic with per-request rotation), and back off with jitter. For pages that genuinely require solving the JS challenge, fall back to Playwright driving a real browser through the same proxy so the challenge script executes.
python
```
import time, random
from curl_cffi import requests as cffi

PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"

def is_blocked(resp) -> bool:
    if resp.status_code in (403, 429, 503):
        return True
    body = resp.text[:2000].lower()
    return "px-captcha" in body or "access denied" in body or "_abck" in body

def fetch(url, max_tries=5):
    for attempt in range(max_tries):
        r = cffi.get(url, proxies={"https": PROXY}, impersonate="chrome124", timeout=25)
        if not is_blocked(r):
            return r
        # fresh exit is automatic on next call; back off with jitter
        time.sleep((2 ** attempt) + random.uniform(0, 1.5))
    raise RuntimeError("exhausted retries - persistent block")
```
Field note: Cap retries and alert on exhaustion rather than looping forever. A URL that blocks five fresh residential exits in a row is telling you the signature moved, not that you were unlucky - burning thousands of good IPs retrying it just accelerates pool reputation decay.
6
Pin a sticky session for multi-step page flows
Most price reads are single requests and should rotate every time. But a few flows - loading a product page, then its size-level market JSON, then a variant endpoint - trust an IP mid-session and will challenge if the exit changes between steps. For those, pin a short sticky session with a token and a lifetime (up to 30 minutes), complete the burst, then let it expire. Never use one sticky session as a long-lived tunnel; that recreates the single-IP velocity problem.
python
```
from curl_cffi import requests as cffi

# Sticky exit for a short multi-request burst: same IP for up to 10 minutes.
STICKY = "http://aethyn-XXXXX-country-us-session-mkt42-lifetime-10:PASSWORD@proxy.aethyn.io:5499"

sess_proxy = {"https": STICKY}
slug = "example-slug"

product = cffi.get(f"https://stockx.com/api/products/{slug}", proxies=sess_proxy, impersonate="chrome124", timeout=25)
sizes   = cffi.get(f"https://stockx.com/api/products/{slug}/market?currency=USD", proxies=sess_proxy, impersonate="chrome124", timeout=25)
# both requests share one residential exit, then the session expires and rotation resumes
```
Field note: Give each sticky session a unique token per worker (mkt42, mkt43...) and keep the lifetime as short as the flow needs - 10 minutes covers most multi-step reads. Reusing one token across all workers funnels their combined traffic onto a single exit, which is the exact velocity spike you rotated to avoid.

Best practices that keep scrapers reliable

Collect only public, non-personal data - resale prices, availability, release dates - keep request volume reasonable, respect each site's Terms of Service and robots posture, and consult counsel for your jurisdiction before running at scale.
Rotate per request by default and reserve sticky sessions for genuine multi-step flows; treating a sticky exit as a long-lived tunnel recreates the velocity signature you are trying to avoid.
Match your proxy geography to the pricing you read - StockX and SNKRS geo-gate, so use -country-us for USD asks and -country-gb for GBP, and never mix currencies in one column.
Pair proxies with a browser-grade TLS fingerprint (curl_cffi impersonate or Playwright); IP rotation alone does not defeat JA3-based detection and will still get challenged.
Validate every payload before storing - assert a non-null, positive price and a non-empty product set, and route failures to retry rather than into your database.
Pre-scale for drop windows: know the launch_utc from the calendar, warm your concurrency ahead of it, and expect challenge rates to rise exactly when traffic peaks.
Cache the drop calendar and diff snapshots over time; historical price and release-time changes are the actual market-intelligence product, not just the latest value.

Common mistakes that burn proxy budget

Using datacenter proxies on StockX or SNKRS - their ASNs are pre-flagged, so you get PerimeterX/Akamai challenges within minutes no matter how clean your headers are.
Swapping only the User-Agent while keeping a Python-requests TLS signature - the JA3 fingerprint gives you away before the header is ever read.
Treating a 200 OK with a null or zero price as a real datapoint - it is almost always a soft block or interstitial, and storing it silently corrupts your valuations.
Retrying a blocked URL on the same IP immediately instead of rotating and backing off - it confirms automation and accelerates that exit's reputation decay.
Running one geography and converting currencies afterward - you miss geo-gated availability and regional release calendars entirely, and FX conversion hides the real localized ask.
Reusing a single sticky session token across all workers - their combined traffic stacks on one exit, producing the velocity spike that gets the IP rate-limited.

Common questions about this scraper problem

Is scraping StockX and sneaker release prices legal?

Collecting public, non-personal data like resale prices, stock availability, and release dates for analytics and market research is generally a different activity from accessing private or personal data, but it can still conflict with a site's Terms of Service. Keep your request volume reasonable, do not collect personal information, respect each site's ToS and stated access rules, and consult a lawyer for your specific jurisdiction and use case - this guide is not legal advice.

Does this cover checkout bots or copping pairs?

No, and deliberately so. Automated buying to beat per-customer purchase limits violates retailer and marketplace terms and is out of scope here. This guide is strictly about reading public price, availability, and release-date data for resale valuation and market research - not adding to cart, checking out, or circumventing purchase limits.

Why do I get blocked even with residential proxies?

Because IP reputation is only one of several signals. PerimeterX and Akamai also fingerprint your TLS ClientHello (JA3), HTTP/2 frame ordering, and header completeness, then score velocity on top. A clean residential IP running a stock Python-requests TLS stack still looks non-browser, so you need to pair the proxy with a browser-grade client like curl_cffi impersonate or Playwright.

Premium or Elite tier for StockX and SNKRS?

Elite (port 5499). These sites run the most aggressive bot management on the retail web and geo-gate pricing, so you want the highest-reputation residential exits and reliable country/city targeting. Premium is fine for softer resale marketplaces, but the flagship StockX and SNKRS surfaces are where Elite pays for itself in reduced challenge rates.

How do I get accurate prices for a specific country?

Target the exit country in the proxy username, e.g. aethyn-XXXXX-country-gb for GBP asks or -country-jp for the Japanese market, because StockX localizes currency and availability by IP. Verify the exit geography at startup by hitting an IP-geo endpoint through the proxy, and never convert currency after the fact - read the localized number directly so you capture geo-gated availability too.

Should I rotate every request or use sticky sessions?

Rotate every request by default - it is the Elite tier's default with no session token and it spreads drop-time velocity across thousands of exits. Use a short sticky session (-session-TOKEN-lifetime-N, up to 30 minutes) only when a multi-step flow like product page then size-level market JSON must stay on one IP, then let it expire.

How do I survive the traffic spike when a hyped pair drops?

Read the launch_utc from the calendar ahead of time, warm your concurrency before the window, and expect challenge and 429 rates to climb exactly when real traffic peaks. Per-request rotation across a large pool is what keeps you from stacking velocity on any single exit, and disciplined backoff-with-jitter on blocks stops you from burning IPs during the crunch.

Why does a 200 response sometimes have no price?

Because challenge pages, interstitials, and empty grids all return HTTP 200. A null or zero lowestAsk is virtually never a real priceless sneaker - it is a soft block or an unlisted variant. Assert on a non-null, positive price before storing and route the miss to a retry on a fresh exit; otherwise phantom sold-out and price-zero rows quietly poison your dataset.

Can I just use a third-party sneaker price API instead?

You can, but you inherit their coverage gaps, freshness, and reliability - and aggregators tend to break or go stale precisely during drops, when you most need current data. Running your own collection through proxies gives you control over geography, refresh cadence, and validation, at the cost of maintaining the anti-bot handling yourself.

How do I keep my proxy pool healthy over time?

Cap retries so you never loop thousands of good IPs against a moved signature, back off on blocks, and monitor your soft-block rate as a first-class metric. If empty-market or challenge rates spike, pause and investigate rather than pushing harder - hammering through a block is the fastest way to reputation-decay a pool fleet-wide.

What goes wrong when this scraper fails

Why this failure mode happens

Challenges that make this hard to automate

TLS/JA3 and HTTP/2 fingerprinting: PerimeterX and Akamai read the shape of your TLS ClientHello and h2 SETTINGS frames before any HTML, so a stock Python-requests or urllib client is identified as non-browser regardless of headers.
Geo-gated pricing and availability: StockX localizes currency, ask/bid, and shipping by IP, and retailer SNKRS calendars differ per country - a single-region proxy pool gives you a distorted, incomplete market view.
Drop-time traffic spikes: the exact windows you most want data (a hyped release going live) are when the origin is under 100x load and its bot defenses tighten, turning steady scraping into a wall of 429s and interstitials.
Soft blocks that return HTTP 200: challenge pages, empty product grids, and null price fields come back as 200 OK, so naive success checks poison your dataset with phantom sold-out or price-zero records.
IP reputation decay: read StockX from a narrow set of exits and those IPs get reputation-flagged fleet-wide, so throughput quietly collapses even though nothing in your code changed.

Approaches that usually fail

Datacenter proxies from a single provider - cheap and fast, but their ASNs are pre-flagged by Akamai/PerimeterX and get challenged or blocked within minutes on StockX and SNKRS.
Headless Chrome/Puppeteer with no proxy rotation - solves the JS challenge but runs every request from one IP, so velocity-based scoring rate-limits or bans the box in a single drop window.
Third-party 'sneaker API' aggregators - convenient until their upstream access breaks during a drop or their data goes stale, and you have no visibility into freshness or geographic coverage.
Hand-rolled residential proxy lists scraped from free sources - unreliable, often already burned, frequently logging your traffic, and impossible to target by country for geo-gated pricing.

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Elite residential pool on clean consumer ASNs that Akamai/PerimeterX score as human, sharply reducing challenge rates versus datacenter IPs on StockX and SNKRS.
Per-request rotation by default (port 5499) so a 100x drop-time spike is spread across thousands of exits with no per-IP velocity signature.
Country and city targeting in the username - -country-us, -country-gb, -country-jp, -city-chicago - to read geo-gated resale prices and regional release calendars accurately.
Short-lived sticky sessions (-session-TOKEN-lifetime-N, up to 30 min) for multi-request page flows that must land on one exit, then rotate away.
Massive concurrent capacity to absorb the spiky, bursty request pattern around scheduled drops without queueing or throttling on the proxy side.
One consistent username-encoded URL format so geo and rotation logic lives in config, not scattered across your codebase.

How to implement this with residential proxies

1
Route requests through country-targeted Elite exits
Start by encoding geo and rotation into the proxy username so every request leaves from a residential IP in the country whose pricing you want. StockX localizes ask/bid and currency by IP, so read US pricing from -country-us and GBP pricing from -country-gb rather than converting after the fact. Leave off any session token so the Elite tier rotates on every request - that is what keeps drop-time velocity off any single exit.
python
```
import requests

# Elite tier -> port 5499. Per-request rotation is the default (no session token).
PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"
proxies = {"http": PROXY, "https": PROXY}

r = requests.get("https://api.ipify.org?format=json", proxies=proxies, timeout=20)
print("exit IP:", r.json()["ip"])  # different IP every call
```
Field note: Verify the exit country before you trust the price. Hit an IP-geo endpoint through the proxy once at startup and assert the country matches your target - a mislabeled exit silently mixes GBP asks into your USD dataset and no error is ever raised.
2
Present a browser-grade TLS and header fingerprint
Rotating IPs removes the reputation signal, but PerimeterX and Akamai still read your TLS ClientHello. Stock requests advertises a Python TLS signature that no Chrome ever sends, so pair the proxy with a client that mimics a real browser's JA3 - curl_cffi with impersonate is the lightest option. Send a complete, ordered header set: a bare User-Agent with no Accept-Language or Sec-CH-UA is a classic bot tell.
python
```
from curl_cffi import requests as cffi

PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"

headers = {
    "Accept": "application/json",
    "Accept-Language": "en-US,en;q=0.9",
    "Sec-CH-UA": '"Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99"',
    "Sec-CH-UA-Mobile": "?0",
    "Sec-CH-UA-Platform": '"macOS"',
}

# impersonate a real Chrome TLS/JA3 fingerprint end-to-end
r = cffi.get(
    "https://stockx.com/api/products/example-slug",
    headers=headers,
    proxies={"https": PROXY},
    impersonate="chrome124",
    timeout=25,
)
print(r.status_code)
```
Field note: Keep the impersonated browser version and your Sec-CH-UA header in lockstep. If you impersonate chrome124 but send a Sec-CH-UA claiming v=120, the mismatch between the TLS-implied version and the header-claimed version is itself a flag Akamai scores.
3
Parse the product JSON and defensively validate prices
StockX product pages hydrate from an internal JSON payload carrying lowestAsk, highestBid, and last-sale market data - read that, not the rendered HTML, so a layout change does not break you. The critical discipline is validation: a 200 response with a null lowestAsk or an empty market object is a soft block or an unlisted variant, never a real zero. Treat missing or zero prices as a failed fetch to retry on a fresh exit, not a datapoint.
python
```
def extract_market(payload: dict) -> dict:
    product = payload.get("Product") or payload.get("product") or {}
    market = product.get("market") or {}
    ask = market.get("lowestAsk")
    bid = market.get("highestBid")
    last = market.get("lastSale")

    # A 200 with null/zero pricing is a soft block, not a free sneaker.
    if not ask or ask <= 0:
        raise ValueError("empty market data - likely challenge/soft block, retry on new exit")

    return {
        "sku": product.get("styleId"),
        "title": product.get("title"),
        "lowest_ask": ask,
        "highest_bid": bid,
        "last_sale": last,
        "spread": (ask - bid) if (ask and bid) else None,
    }
```
Field note: Log the raw response length and status alongside every parse failure. Soft blocks cluster - if your empty-market rate jumps from 1% to 30% in a five-minute window, a signature changed or a pool went hot, and you want that visible on a dashboard, not buried.

Scrape retailer drop calendars and normalize release dates

python

from curl_cffi import requests as cffi
from datetime import datetime, timezone

# City targeting for regionally-gated retailer inventory.
PROXY = "http://aethyn-XXXXX-country-us-city-chicago:PASSWORD@proxy.aethyn.io:5499"

resp = cffi.get(
    "https://www.example-retailer.com/api/launch-calendar",
    proxies={"https": PROXY},
    impersonate="chrome124",
    timeout=25,
).json()

releases = []
for item in resp.get("entries", []):
    raw = item.get("launchTime")  # ISO8601 with offset
    dt_utc = datetime.fromisoformat(raw).astimezone(timezone.utc)
    releases.append({
        "name": item.get("title"),
        "sku": item.get("styleCode"),
        "retail": item.get("price"),
        "launch_utc": dt_utc.isoformat(),
        "mechanic": item.get("launchType"),  # e.g. FCFS / DRAW
    })

5
Handle JS challenges and 429s with backoff and rotation
When a request comes back as a PerimeterX interstitial (often a 403 with a px-captcha body) or a 429, the wrong move is to retry the same URL immediately - that confirms you are automated. Detect the block class, rotate to a fresh exit (automatic with per-request rotation), and back off with jitter. For pages that genuinely require solving the JS challenge, fall back to Playwright driving a real browser through the same proxy so the challenge script executes.
python
```
import time, random
from curl_cffi import requests as cffi

PROXY = "http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499"

def is_blocked(resp) -> bool:
    if resp.status_code in (403, 429, 503):
        return True
    body = resp.text[:2000].lower()
    return "px-captcha" in body or "access denied" in body or "_abck" in body

def fetch(url, max_tries=5):
    for attempt in range(max_tries):
        r = cffi.get(url, proxies={"https": PROXY}, impersonate="chrome124", timeout=25)
        if not is_blocked(r):
            return r
        # fresh exit is automatic on next call; back off with jitter
        time.sleep((2 ** attempt) + random.uniform(0, 1.5))
    raise RuntimeError("exhausted retries - persistent block")
```
Field note: Cap retries and alert on exhaustion rather than looping forever. A URL that blocks five fresh residential exits in a row is telling you the signature moved, not that you were unlucky - burning thousands of good IPs retrying it just accelerates pool reputation decay.
6
Pin a sticky session for multi-step page flows
Most price reads are single requests and should rotate every time. But a few flows - loading a product page, then its size-level market JSON, then a variant endpoint - trust an IP mid-session and will challenge if the exit changes between steps. For those, pin a short sticky session with a token and a lifetime (up to 30 minutes), complete the burst, then let it expire. Never use one sticky session as a long-lived tunnel; that recreates the single-IP velocity problem.
python
```
from curl_cffi import requests as cffi

# Sticky exit for a short multi-request burst: same IP for up to 10 minutes.
STICKY = "http://aethyn-XXXXX-country-us-session-mkt42-lifetime-10:PASSWORD@proxy.aethyn.io:5499"

sess_proxy = {"https": STICKY}
slug = "example-slug"

product = cffi.get(f"https://stockx.com/api/products/{slug}", proxies=sess_proxy, impersonate="chrome124", timeout=25)
sizes   = cffi.get(f"https://stockx.com/api/products/{slug}/market?currency=USD", proxies=sess_proxy, impersonate="chrome124", timeout=25)
# both requests share one residential exit, then the session expires and rotation resumes
```
Field note: Give each sticky session a unique token per worker (mkt42, mkt43...) and keep the lifetime as short as the flow needs - 10 minutes covers most multi-step reads. Reusing one token across all workers funnels their combined traffic onto a single exit, which is the exact velocity spike you rotated to avoid.

Best practices that keep scrapers reliable

Collect only public, non-personal data - resale prices, availability, release dates - keep request volume reasonable, respect each site's Terms of Service and robots posture, and consult counsel for your jurisdiction before running at scale.
Rotate per request by default and reserve sticky sessions for genuine multi-step flows; treating a sticky exit as a long-lived tunnel recreates the velocity signature you are trying to avoid.
Match your proxy geography to the pricing you read - StockX and SNKRS geo-gate, so use -country-us for USD asks and -country-gb for GBP, and never mix currencies in one column.
Pair proxies with a browser-grade TLS fingerprint (curl_cffi impersonate or Playwright); IP rotation alone does not defeat JA3-based detection and will still get challenged.
Validate every payload before storing - assert a non-null, positive price and a non-empty product set, and route failures to retry rather than into your database.
Pre-scale for drop windows: know the launch_utc from the calendar, warm your concurrency ahead of it, and expect challenge rates to rise exactly when traffic peaks.
Cache the drop calendar and diff snapshots over time; historical price and release-time changes are the actual market-intelligence product, not just the latest value.

Common mistakes that burn proxy budget

Using datacenter proxies on StockX or SNKRS - their ASNs are pre-flagged, so you get PerimeterX/Akamai challenges within minutes no matter how clean your headers are.
Swapping only the User-Agent while keeping a Python-requests TLS signature - the JA3 fingerprint gives you away before the header is ever read.
Treating a 200 OK with a null or zero price as a real datapoint - it is almost always a soft block or interstitial, and storing it silently corrupts your valuations.
Retrying a blocked URL on the same IP immediately instead of rotating and backing off - it confirms automation and accelerates that exit's reputation decay.
Running one geography and converting currencies afterward - you miss geo-gated availability and regional release calendars entirely, and FX conversion hides the real localized ask.
Reusing a single sticky session token across all workers - their combined traffic stacks on one exit, producing the velocity spike that gets the IP rate-limited.

Common questions about this scraper problem

Is scraping StockX and sneaker release prices legal?

Does this cover checkout bots or copping pairs?

Why do I get blocked even with residential proxies?

Premium or Elite tier for StockX and SNKRS?

How do I get accurate prices for a specific country?

Should I rotate every request or use sticky sessions?

How do I survive the traffic spike when a hyped pair drops?

Why does a 200 response sometimes have no price?

Can I just use a third-party sneaker price API instead?

How do I keep my proxy pool healthy over time?

Tracking StockX Resale Prices and Sneaker Drop Calendars at Scale with Proxies

Key takeaways

On this page

What goes wrong when this scraper fails

Challenges that make this hard to automate

How Aethyn residential proxies help here

How to implement this with residential proxies

Route requests through country-targeted Elite exits

Present a browser-grade TLS and header fingerprint

Parse the product JSON and defensively validate prices

Scrape retailer drop calendars and normalize release dates

Handle JS challenges and 429s with backoff and rotation

Pin a sticky session for multi-step page flows

Best practices that keep scrapers reliable

Common questions about this scraper problem

Solve this with Aethyn residential proxies

Tracking StockX Resale Prices and Sneaker Drop Calendars at Scale with Proxies

Key takeaways

On this page

What goes wrong when this scraper fails

Challenges that make this hard to automate

How Aethyn residential proxies help here

How to implement this with residential proxies

Route requests through country-targeted Elite exits

Present a browser-grade TLS and header fingerprint

Parse the product JSON and defensively validate prices

Scrape retailer drop calendars and normalize release dates

Handle JS challenges and 429s with backoff and rotation

Pin a sticky session for multi-step page flows

Best practices that keep scrapers reliable

Common questions about this scraper problem

Solve this with Aethyn residential proxies

Key takeaways

On this page

What goes wrong when this scraper fails

Challenges that make this hard to automate

How Aethyn residential proxies help here

How to implement this with residential proxies

Route requests through country-targeted Elite exits

Present a browser-grade TLS and header fingerprint

Parse the product JSON and defensively validate prices

Scrape retailer drop calendars and normalize release dates

Handle JS challenges and 429s with backoff and rotation

Pin a sticky session for multi-step page flows

Best practices that keep scrapers reliable

Common questions about this scraper problem

Related guides & resources

Solve this with Aethyn residential proxies

Key takeaways

On this page

What goes wrong when this scraper fails

Challenges that make this hard to automate

How Aethyn residential proxies help here

How to implement this with residential proxies

Route requests through country-targeted Elite exits

Present a browser-grade TLS and header fingerprint

Parse the product JSON and defensively validate prices

Scrape retailer drop calendars and normalize release dates

Handle JS challenges and 429s with backoff and rotation

Pin a sticky session for multi-step page flows

Best practices that keep scrapers reliable

Common questions about this scraper problem

Related guides & resources

Solve this with Aethyn residential proxies