A Queue-it waiting room lets you into a site only with a signed pass. Queue-it hands out that pass when your turn comes. No proxy, second tab or browser extension can make one.
What gets you through stays inside the site's rules. Allow the site's cookies and stay in one browser. Keep one IP address until the site has let you in, and be there on time for a scheduled sale. If the site sends you back to the line again and again, check cookies first. A CAPTCHA or a 403 at the door means the operator has a rule for your kind of connection.
Everything below comes from Queue-it's documentation and from the code of its three public connectors, read on 14 September 2026. Where Queue-it's own help pages are gone, we use the help pages of two sites that sell through Queue-it.
Which screen are you seeing?
Queue-it publishes a test layout of its waiting room page on its static assets domain. That page shows your number in line, the visitors ahead of you, an expected arrival time and a Queue ID. It also offers an email alert for your turn. Its link to leave the line warns that you will lose your place. In the test layout, a visitor has 10 minutes to enter once the turn comes.
Find the row that matches your screen.
| What you see | What it means | What to do |
|---|---|---|
| Your address changes to a queue-it.net page with your place in line | The site sent you to its waiting room because you carry no valid pass | Wait in that tab. Leave an email address if the page offers an alert |
| A countdown before a sale | You are in the pre-queue | Be there before the start. Everyone in it gets a random place when the sale opens |
| You are sent back to the line again and again | The site cannot find the cookie that proves you queued | Allow cookies for the site and finish in the browser you queued in |
| Your turn came, then the site sent you back | The pass failed a check: its signature, its expiry, or the IP address it was bound to | Try again from the same browser and the same connection |
| You missed your turn | Your session expired | Join the line again |
| A CAPTCHA before you can join | The operator challenges some traffic, for example data center addresses | Solve it, or leave the VPN or proxy and use your home connection |
| 403 Forbidden at the waiting room | A block rule matched your connection | Leave the VPN or proxy and use your home connection |
| A request for an invitation, an email address or a code | The waiting room is invite-only | Only visitors on the site's list get in |
Sources for the table: Queue-it's product and developer pages, its connector code as read on 14 September 2026, the Royal Australian Mint's Queue-it FAQ, and Sideshow's help page, updated 10 September 2026.
Can a proxy, a second tab or a bypass tool skip the line?
No, on any site that checks the pass on its server or at its edge. Queue-it's developer documentation says a request without a valid token is redirected to Queue-it with an HTTP 302. The token is signed with an HMAC-SHA256 made from the site's 72-character secret key. That key sits in the site's connector, on its server or at its edge. Nothing on your side can sign a pass.
A new IP address changes where a request comes from. It does not give the request a pass.
Queue-it names one setup that can be skipped. A client-side integration runs only as JavaScript in the page. Queue-it's documentation calls it vulnerable to visitors manipulating the code to skip the line. Browser tricks that block Queue-it's script work only in that case. A server-side or edge connector checks the request before any page is sent, so there is no script to block.
Tools that open many sessions or rotate addresses also meet the operator's rules. Queue-it lets operators challenge or block visitors on data center addresses. It can also make each browser solve a Proof-of-Work puzzle before it gets a place in line. Every place a bot tries to take then costs it computing power.
Ticket sales carry a legal line as well. In the United States, the BOTS Act of 2016 covers them. It makes it unlawful to circumvent the access controls a ticket issuer uses to enforce its posted ticket limits or its posted purchasing order rules. The Federal Trade Commission announced its first cases under the Act on 22 January 2021, and the conduct it described included software that concealed IP addresses.
Is the line random, or first come, first served?
A site can place the waiting room in front of everything or in front of one step. Queue-it's product page lists a whole site, a landing page, a login page, or one request such as Add to Cart. The waiting room then runs in one of two ways.
The first way protects against traffic spikes. Queue-it calls this mode Visible at Peak. The waiting room activates only when inflow passes a threshold the operator sets, in visitors per minute. In this mode, Queue-it says, the line is first in, first out.
The second way serves a scheduled sale. Visitors who arrive early wait in a pre-queue with a countdown. When the sale starts, Queue-it randomizes everyone in the pre-queue and assigns positions, and its blog compares the draw to a raffle. Visitors who arrive after the start join behind them, first come, first served. Arriving early in the pre-queue gives no better chance than arriving a minute before the start.
The operator also sets the outflow: how many visitors per minute the waiting room lets through to the site. The operator can change it during the event, through Queue-it's API or its admin platform.
What the Queue-it pass checks
When your turn comes, Queue-it sends you back to the site with a token named queueittoken in the address. We read the code that checks it on 14 September 2026, in Queue-it's public JavaScript, ASP.NET and Java connectors. The token carries the waiting room ID, a queue ID, an expiry time, cookie settings, the redirect type and a hash. It can also carry a hash of your IP address.
The site's connector refuses the token in four cases:
- the HMAC does not match the token's content
- the waiting room ID is not the one the site set up
- the expiry time has passed
- the token carries an IP hash that does not match the address of the request
The customer ID is not part of the check. After a valid token, Queue-it's example code reloads the address without it, which its documentation says avoids sharing a user-specific token. Then it stores a cookie named QueueITAccepted-SDFrts345E-V3_ plus the waiting room ID. Later requests are checked against that cookie instead of the token.
The cookie carries its own HMAC over its values, so an edited cookie fails the next check. The site decides how long the cookie stays valid. Queue-it's own example sets 15 minutes and extends the time on every check.
The IP check is optional, and the operator decides whether to use it. In the JavaScript connector, a token or cookie that carries an IP hash is refused when a request arrives from another address. A proxy that changes your IP between the waiting room and the site breaks exactly that check.
No valid pass
302 to the waiting room
Waiting room
a draw, or first come, first served
queueittoken
HMAC-SHA256, can carry an IP hash
Cookie
set after the check, read on later requests
What costs you your place in line
| While you wait or enter | What happens | Source |
|---|---|---|
| Close the browser | You keep your place | Royal Australian Mint, Queue-it FAQ |
| Your phone goes to sleep | You keep your place | Royal Australian Mint, Queue-it FAQ |
| Refresh the page | You keep your place | Sideshow help page, updated 10 September 2026 |
| Miss your turn | Your session expires and you start over | Royal Australian Mint, Queue-it FAQ |
| Click the link to leave the line | You lose your place, as the link itself warns | Queue-it's test layout of the waiting room page |
| Block or delete the site's cookies | The site sends you back to the waiting room | Royal Australian Mint, Queue-it FAQ; Queue-it connector code |
| Change IP address when the pass is bound to one | The site refuses the pass | Queue-it JavaScript connector code |
| Queue from a data center address under a challenge or block rule | A CAPTCHA, or a 403 Forbidden | Queue-it, data center IP blocking, updated 17 April 2025 |
| Arrive early for a scheduled sale | No advantage, because the pre-queue is randomized at the start | Queue-it, What is a pre-queue? |
Where a proxy fits
A proxy cannot move you forward in a Queue-it line. It changes only the address that the waiting room and the site see. Two of Queue-it's rules read that address.
The first is the data center rule. Queue-it says it gets its list of data center addresses from trusted third parties and keeps it updated. Its post on the rule, updated 17 April 2025, counts 13% of waiting room traffic from data centers. The same post says data centers hold only 3% of all IP addresses. A VPN or proxy exit in a data center matches that rule, and the site then shows a CAPTCHA or a 403.
Our proxy checker shows the network that owns each address you test, by name and ASN. The name tells you whether the owner is a hosting company or an internet provider. Queue-it uses its own list, so treat that as a first check, not a promise.
The second is the IP binding. When a site binds the pass to an address, it refuses the token and the cookie on any request from a different address. A rotating proxy that changes the IP on each request fails that check. A sticky session keeps one exit for a set time, as we explain in sticky versus rotating sessions.
Some readers test their own waiting room from other countries, or need one stable address for another reason. Our residential proxies can keep one address for a set time with a sticky session, and our ISP proxies also come as one static address you hold. They still wait in line like every other visitor. Only a signed pass gets anyone in.
Behind the waiting room, a site can run other bot checks that read your browser, not only your address. How websites detect proxies covers those signals, and our guides to DataDome and Cloudflare cover two of those walls.
If none of this works
Only the site's operator can see its own rules. Those rules include IP binding, the connections it challenges and how long its cookie lasts. If the site still sends you back after the steps above, contact the site. Give the time, the page, the Queue ID from the waiting room page and what you saw on screen.
What this page could not check
We did not run a live Queue-it waiting room. The visitor behaviour above rests on the help pages of the Royal Australian Mint and Sideshow, two sites that sell through Queue-it. Queue-it's own support articles on the same questions returned 404 on 14 September 2026.
The code we read is version 3 of Queue-it's public connectors. Queue-it keeps the detailed documentation of its version 4 connector in private repositories. Its developer documentation, read again on 15 September 2026, adds that version 5 skips the redirect when no queue is active. The IP check appears in the JavaScript connector only, not in the ASP.NET and Java code we read. From outside, nobody can see which options a site has switched on. We will check these sources again by 14 March 2027.
Sources
- Queue-it, Virtual waiting room, product page, read 14 September 2026: queue-it.com/virtual-waiting-room.
- Queue-it, What is a pre-queue?, read 14 September 2026: queue-it.com/pre-queue.
- Queue-it, Why first-in-first-out queuing isn't (always) the answer, 15 October 2024, updated 10 November 2025: queue-it.com/blog/first-in-first-out-randomization.
- Queue-it Developer Resources, How Queue-it works, read 14 September 2026: queue-it.com/developers/how-queue-it-works.
- Queue-it Developer Resources, Bot and abuse management, read 14 September 2026: queue-it.com/developers/bots-abuse-management.
- Queue-it Developer Resources, JavaScript Connector v4, read 14 September 2026: queue-it.com/developers/connectors/node-js-connector.
- Queue-it, KnownUser.V3.JavaScript, release 3.7.12 of 26 July 2022, GitHub, code read at the commit of 11 July 2025: github.com/queueit/KnownUser.V3.JavaScript.
- Queue-it, KnownUser.V3.ASPNET and KnownUser.V3.JAVA, release 3.7.0 of 3 December 2021, GitHub, code read at the commits of 11 July 2025: github.com/queueit/KnownUser.V3.ASPNET, github.com/queueit/KnownUser.V3.JAVA.
- Queue-it, Improve bot protection with new data center IP blocking, 31 January 2020, updated 17 April 2025: queue-it.com/blog/data-center-ip-blocking.
- Queue-it, Traffic Access Rules, 31 October 2023, updated 5 May 2026: queue-it.com/blog/traffic-access-rules.
- Queue-it, The Proof-of-Work challenge, 28 May 2020, updated 17 April 2025: queue-it.com/blog/proof-of-work-block-bad-bots.
- Queue-it, Invite-only waiting room, product page, read 14 September 2026: queue-it.com/product/invite-only.
- Royal Australian Mint, Queue IT FAQ, read 14 September 2026: ramint.gov.au/queue-it-faqs.
- Sideshow, Queue It Waiting Rooms, knowledge base, updated 10 September 2026: help.sideshow.com.
- United States Code, 15 U.S.C. 45c, from the Better Online Ticket Sales Act, Pub. L. 114-274, 14 December 2016, as published by the Legal Information Institute: law.cornell.edu/uscode/text/15/45c.
- Federal Trade Commission, FTC Brings First-Ever Cases Under the BOTS Act, 22 January 2021: ftc.gov.
- Our own reading of the token and cookie code in the three connectors, 14 September 2026, logged in the research folder for this page.
