Proxies for Costco: Two Price Lists, One Membership Wall

Proxies for Costco give your price tracker, stock monitor or member session its own clean US IP address, so Costco.com sees a set of ordinary shoppers rather than one machine reading the whole catalog. Costco is an unusual retail target because the store is a membership club first and a website second: most of the catalog is priced for members, non-members pay a 5 percent surcharge online, and the online price list is not the warehouse price list. The proxy question here is really two questions, one about reading prices at scale and one about keeping a logged-in membership session alive, and they want different products.

We sent Costco.com a single plain request from two places on 24 August 2026, a home connection and a datacenter server, and both got the homepage back with Akamai Bot Manager's sensor cookies attached and the Queue-it waiting-room client loaded in the page. That is the whole defense in one response: the door is open, the sensor is watching, and a queue is standing by for the items people actually fight over.

What proxies work best for Costco?

For scraping prices and availability, US rotating residential proxies behind a real browser, because Akamai scores the browser as well as the IP. For member accounts and hot-item purchases, a static ISP proxy that holds one IP through the queue and the checkout. Datacenter is for testing only, and free lists are for learning the site's shape before you spend money.

Costco has more than one price, and that is the point

Three facts about Costco shape every data project against it.

First, the website and the warehouse are priced separately. Costco's own customer service page says not all products sold on Costco.com are available in a local warehouse, and that warehouse-only promotions and shipping costs mean some online products carry different pricing than local warehouse items (Costco, are warehouse and online prices the same). Costco.com folds shipping into the item price, so a product that exists in both channels usually costs more online. Anyone tracking "the Costco price" has to decide which price they mean.

Second, the price you see depends on who you are. Non-members can buy on Costco.com but pay a 5 percent surcharge over posted member prices, prescription drugs excepted (Costco, non-member surcharge). A scraper that never logs in is reading the non-member view of the store, which is fine for relative price movement and wrong for absolute comparison against a member's receipt.

Third, Costco rations. The best-known case is bullion: Costco started selling one-ounce gold bars in 2023, they sell out within hours of being loaded, and the listing now limits buyers to one transaction per membership and a maximum of two units in 24 hours (Money, Costco tightens gold bar sales). Limits like that are enforced on the membership, which is why the buying side of Costco is an account problem before it is an IP problem.

Underneath all of it sits scale. Costco operated 914 warehouses at the end of fiscal 2025, 629 of them in the United States and Puerto Rico, 110 in Canada, 42 in Mexico, 37 in Japan and 29 in the United Kingdom (Costco 10-K, fiscal 2025). Each country runs its own site with its own catalog and currency, and delivery availability on Costco.com keys off a ZIP code, so a reader in the wrong country, or with no ZIP set, collects a catalog no local member sees.

What Costco.com does to automated traffic

The homepage itself is not the wall. What we observed in the first response, from both a residential and a datacenter address, tells you where the walls are.

• Akamai Bot Manager. Every response set _abck, bm_sz, bm_s and bm_so. Those are Akamai's sensor cookies: a script in the page collects a device fingerprint and behavioral signals and posts them to Akamai, and only after that sensor data validates does _abck reach a state that lets product and cart requests through. A bare HTTP client never runs the sensor, so it can load a cached homepage and still fail the moment it asks for something Costco protects. The mechanics of that cookie are in how the _abck cookie works, and the general playbook is in how to scrape past Akamai.
• A Queue-it waiting room, already loaded. The page pulls queueclient.min.js from static.queue-it.net and whitelists *.queue-it.net in its content security policy. Queue-it works by intercepting requests to a protected page, parking visitors on a waiting page when demand exceeds a configured rate, and releasing them in order with a token that lets that one session browse and buy (Queue-it, how it works). The token belongs to the session that waited, which means the IP that entered the queue has to be the IP that checks out. Our guide to getting through Queue-it goes deeper.
• Device reputation and order screening. The same policy allows mpsnare.iesnare.com (iovation, a device-reputation service now owned by TransUnion) and the page references Forter, an order-fraud platform. Neither looks at the IP alone; both look at the device and the order history. This is where accounts that share hardware or payment details get tied together after the fact.
• Bazaarvoice reviews. Ratings and reviews on Costco.com come from Bazaarvoice, so review data is a separate JSON surface with its own limits rather than something buried in product HTML.

The practical consequence: an IP change anywhere in that chain resets you to the back of the line, and a client that skips the sensor never gets into the chain at all.

Which proxy type fits which Costco job

Rotating residential is the workhorse for reading. The IPs are real home connections, so Akamai's reputation check passes, and you buy bandwidth through a pool instead of managing named addresses. ISP proxies are static residential addresses on datacenter hardware: they keep the home-connection reputation and never change, which is what a logged-in membership needs. Mobile proxies are the expensive tier for sessions that keep getting flagged; most Costco work never needs them. The split between the two residential flavors is explained in rotating vs static residential proxies.

Free proxies against Costco

Free lists are almost entirely datacenter addresses shared by thousands of people, and most of them die within minutes. Against Costco they are better than their reputation for one narrow thing and useless for everything else. The narrow thing: the homepage and cached category pages load from a datacenter IP without a challenge, so a free proxy is enough to confirm your parser reads a product page correctly before you pay for bandwidth. Everything else, sustained reads, anything behind the login, anything in a queue, fails on the sensor or on the shared IP's reputation long before it fails on Costco's patience.

Our free proxy list refreshes every few minutes across 100+ countries and four protocols, and the proxy checker tells you whether an address is alive and where it exits. Use them for the test. For the run, paid residential starts at $0.44/GB pay-as-you-go with no KYC, so a first pass over a few thousand product pages costs cents, and the full comparison is in datacenter vs residential proxies.

Setting it up

Decide which price list you are reading. Logged out, you get non-member pricing with the 5 percent surcharge baked in. Logged in as a member, you get member pricing, but every request now belongs to one identity, so it has to ride one sticky IP and a normal human pace. Do not mix the two in one dataset.

Set the delivery ZIP and country deliberately. Costco.com uses a ZIP for delivery availability and Same-Day, and it takes its first guess from your IP. A US residential exit in the region you care about, with the ZIP set explicitly in the session, gives you the catalog a member in that area sees. For costco.ca or costco.co.uk, exit from that country; a US IP on the Canadian site is both wrong data and a reputation flag.

Drive a real browser for anything Akamai protects. Product, search and cart requests need a valid _abck, and only the sensor script running in a real browser produces one. Playwright or Puppeteer behind the proxy, with cookies persisted across the run, is the standard setup (proxies for Playwright, proxies for Puppeteer). Keep the TLS fingerprint honest too: Akamai reads the JA3/JA4 signature before any HTTP arrives, which is why a plain requests script fails from a perfectly clean IP (what is JA3/JA4 fingerprinting).

Pick rotation by state. Stateless product reads take a fresh IP per request or per short window. A member session, a cart, a Same-Day page or a queue holds one exit for the whole flow. The choice is laid out in sticky vs rotating proxy sessions.

How many IPs

For reading, size from request rate. Find the pace at which one residential IP starts drawing challenges, stay under it, and add IPs to raise total throughput rather than pushing one harder. With rotating residential you buy gigabytes, and a headless browser costs more of them per page than a bare client would, a real cost we measured in headless browser proxy bandwidth cost.

For accounts, size from identities.

One membership  ->  one static ISP IP, US, held for the whole session
Three memberships in a household  ->  three IPs, three devices, three payment methods

Never:
  membership A  ->  203.0.113.10
  membership B  ->  203.0.113.10   (shared exit = linked accounts)

Two memberships behind one address is the pattern a retailer's device-reputation layer exists to catch, and the proxy is only one of the signals it reads. Our pricing is pay-as-you-go with a balance that does not expire, so a batch of ISP IPs for a launch week does not commit you to a monthly plan.

Staying unblocked on Costco

• Pace like a member. Nobody reads four hundred product pages a minute. Space requests, add jitter, and back off when a challenge appears instead of retrying it. The full checklist is in avoiding IP bans while scraping.
• Keep the cookies. Throwing away _abck and bm_sz every request forces the sensor to start over and reads as a bot no matter how clean the IP.
• One session, one IP, through the queue. If Queue-it is active on a page, the IP that entered is the IP that must finish.
• Do not reuse burned pools. Cheap shared residential lists that other Costco scrapers have already used arrive with Akamai's score against them.
• Watch the challenge rate. Rotation hides individual blocks, so log the share of requests that come back as challenges or Access Denied and treat a rising number as the signal to slow down or grow the pool.

What a proxy does not do here

A proxy fixes IP reputation, geography and session isolation. It does not run Akamai's sensor, it does not move you up a Queue-it line, it does not lift a per-membership limit, and it does not make one household look like three to a device-reputation service that reads hardware, payment and address. Scraping Costco.com and running multiple memberships from one household both run against Costco's terms, which is a risk you carry regardless of the IPs.

What a good proxy does is give an honest setup a fair chance: region-correct residential exits for reading, a static ISP address for the session that has to persist, and enough of each that no single IP is asked to behave like a machine. Start with the free proxy list to test the parser, then pin residential at $0.44/GB to the region you are reading, and compare both price lists before you trust either one.

Sources

• Costco customer service, Are warehouse and online prices the same?
• Costco customer service, Why am I being charged a non-member surcharge?
• Costco Wholesale, annual report for fiscal year ending 31 August 2025 (Form 10-K), warehouse counts by country.
• Money, Costco tightens gold bar sales amid surging demand, the per-membership limit.
• Queue-it, How Queue-it works.
• Costco.com response headers and page source as observed by HProxy on 24 August 2026 from a residential connection and from a datacenter server: Akamai sensor cookies (_abck, bm_sz, bm_s, bm_so), the Queue-it client script, and content security policy entries for queue-it.net, iesnare.com and bazaarvoice.com.