How to block (or flag) B2B orders that exceed a credit limit at Shopify checkout

Updated August 7, 2026

You’ve set credit limits on your wholesale accounts. Now a company that’s already over its limit adds another order and clicks checkout. What stops them? On native Shopify, the answer is: nothing. This guide explains why native checkout can’t enforce a credit limit, what mechanism actually can, and the three ways to handle an over-limit buyer — from a gentle nudge to a hard stop.

Why native Shopify can’t stop it

Native Shopify B2B has no concept of a credit limit, so there’s nothing for it to enforce. A payment term like Net 30 controls when an invoice is due; it places no ceiling on total balance and triggers no action when a buyer is carrying too much. As far as checkout is concerned, an over-limit B2B order looks identical to a healthy one, and it sails straight through.

The one native lever is the per-location “all orders to draft” flag, which sends every order from a company to a draft you approve by hand. That’s a manual gate, not enforcement — it depends on you catching the over-limit buyer during review, every single time. At any real volume, that’s not a control you can rely on.

The mechanism that can: a Cart Validation Function

To act on a credit limit at checkout, automatically, you need a Shopify Cart Validation Function (CVF). This is a checkout extension that evaluates the cart and can reject it — the one kind of extension that can actually prevent an order from completing, rather than just displaying a warning the buyer can ignore.

Quay uses a Cart Validation Function to hard-block checkout for companies that should be stopped. A few properties make it safe to run on your live checkout:

• It reads credit state directly from Shopify. The company’s limit and enforcement status live in Shopify metafields; the function reads them at checkout with no external network call, so it’s fast and has no third-party dependency in the buyer’s path.
• It runs within Shopify’s performance budget. The function executes under Shopify’s per-invocation time limit — well under what a buyer would ever notice.
• It fails open. If the function errors or its data is missing, the order is allowed through. Blocking a paying customer because of a bug is worse than letting one over-limit order slip, so the default on failure is always to allow.

The three ways to handle an over-limit buyer

Blocking is the firmest option, not the only one. Quay resolves every company to one of three responses, so you can match firmness to risk:

1. Monitor only. Checkout is unchanged. The limit is tracked and shown on your dashboard, but nothing stops the buyer. Good for a new account you’re still learning.
2. Hide net terms (pay on order). The buyer keeps the ability to check out, but loses the deferred-payment option — they pay on the order to complete it. Their terms return automatically once they’re back under the limit. This is a soft, self-resolving brake.
3. Block new orders. Checkout stops with a clear message that includes your accounts contact (“Your account is on hold — please contact [email protected]”), so the buyer knows exactly who to talk to.

When to block vs. when to soften

A deliberate rule sits underneath this: being over the limit is soft by default. Out of the box, an over-limit buyer isn’t hard-blocked — the worst that happens is they pay upfront. That’s because over-limit is often temporary and benign: a good customer placing this week’s orders slightly ahead of last week’s payment.

But “pay upfront” isn’t always what you want. It still sends goods out to a company that’s already deep past its limit — sometimes you’d rather the order stopped until someone has talked to them. For those cases, a policy can set its over-limit response to Block new orders: any order that would push the company past its available credit is stopped outright at checkout, while smaller orders that still fit go through. It’s opt-in per policy, so you apply it only to the trust levels that need it. How the option works →

Beyond the limit itself, hard block also covers two situations that always warrant stopping an order:

• Overdue. The company has invoices past their due date — a different, more serious signal than simply being over the limit. Your AR aging view is what surfaces this.
• Manual hold. You’ve explicitly placed the company on hold, overriding its policy, because you know something the numbers don’t.

You don’t wire this up per order. You assign each company a policy — Standard, Trusted, VIP, Probation, or High Risk — that decides which response applies and how an account escalates from monitored, to pay-on-order, to blocked as it goes overdue. Set it once per trust level; it applies consistently to every company assigned that policy, with a per-company manual override for the exceptions.

What a block can’t do: stop your own team

Checkout validation stops buyers. It doesn’t stop someone working in your Shopify admin.

When a staff member completes a draft order for a blocked company, Shopify shows the block, then offers a button to proceed anyway. Permission to complete draft orders includes permission to override validation, and nothing separates the two. Phone orders, counter sales and rush jobs all go that way.

Since you can’t prevent it, Quay makes it visible: a Telegram message the moment an order gets past a block — order, amount, company, reason, who placed it, and a link to the order. How the alerts work →

In short

Native Shopify checkout can’t enforce a credit limit because it has no limit to enforce. A Cart Validation Function can — safely, quickly, and fail-open. Use it as the hard end of a three-step ladder: monitor the accounts you trust, make over-limit buyers pay on the order, and reserve the outright block for accounts that are overdue, on hold — or over the limit, where you’ve decided the limit is a wall, not a speed bump. That’s the difference between hoping buyers respect their limits and knowing your checkout enforces them.

New to the whole picture? Start with how to set B2B credit limits in Shopify, then come back here for enforcement.