Connecting and managing your identity provider for customer accounts

You can connect your own identity provider to Shopify customer accounts to provide customers with a tailored sign-in experience across all platforms. This guide helps you through the setup process, from configuring your customer accounts and identity provider settings to completing the connection in your Shopify admin.

Before you connect your identity provider, review the Requirements for connecting your own identity provider.

Considerations for connecting your identity provider

Review the following considerations for connecting your own identity provider to customer accounts:

• You can connect multiple identity providers to Shopify, but you can only have one active identity provider at a time on your online store.
• The customer email address and the sub claim are used to identify customers. You can also sync additional customer data such as name, phone number, address, and tags from your identity provider to Shopify.
• Customer sessions are valid for 90 days by default. Token expiration times are set by your identity provider.

Connect to an identity provider

To connect to your own identity provider, you need to complete the following tasks in order:

• Step 1: Configure your customer accounts settings.
• Step 2: Configure settings in your identity provider dashboard.
• Step 3: Complete your identity provider connection in your Shopify admin.
• Step 4: Add the Sign in with Shop button to your external sign-in page, when you have Shop Pay activated on your store.

Step 1: Configure your customer accounts settings

1. From your Shopify admin, go to Settings > Customer accounts.

2. In the Identity provider section, click Manage.

3. Click Connect to provider.

4. In the Identity provider name field, enter the identity provider name for your authentication service.

5. Keep the Connect to identity provider page open so that you can copy the Callback URL and Logout URLs from the Setup configurations section as you configure your identity provider settings.

Step 2: Configure your identity provider settings

After you complete the steps in your Shopify admin to connect to an identity provider, you need to configure the following settings in your identity provider dashboard. Set up steps vary depending on the provider that you're connecting to. Contact your identity provider for support with any setup steps in your identity provider dashboard.

Steps:

1. In a separate browser tab, open your identity provider dashboard.
2. Register your application: Create a confidential application in your identity provider dashboard, and then obtain the client_id and client_secret.
3. Configure the redirect and logout URLs: In your identity provider dashboard, enter the Callback URL and Logout URLs that are provided in the Setup configurations of the Connect to your identity page in your Shopify admin.
4. Define scopes: In your identity provider dashboard, ensure that the scopes include email and openid.

5. Set up endpoints: Ensure that the following endpoints are set up in your identity provider dashboard:
   • Authorization
   • Token
   • JWKS
   • Discovery: Depending on your identity provider, the Discovery endpoint might have a different name, such as Configuration, or Well-Known Configuration.
6. Locate your identity provider's post-logout redirect URI parameter. Depending on your identity provider, this might be named the post_logout_redirect_uri, logout_uri, or returnTo.
7. Keep this page open in a browser tab to refer to as you complete your identity provider connection.

Step 3: Complete your identity provider connection

After you configure your identity provider settings in your identity provider dashboard, you need to return to your Shopify admin to complete and test your connection.

Steps:

1. Return to the Connect to identity provider page in your Shopify admin.
2. In the Application info section, fill in the required information as it displays in your identity provider settings.
3. Click Save.
4. Click Test connection, and then test that your identity provider's authentication redirects to your customer accounts. If you've recently logged into your customer account on your online store, then you might need to log out and then log back in to test the new sign-in flow.
5. After you test your connection, click Activate.

After you activate your new identity provider, an Active badge displays next to your new identity provider name in the Identity provider section of your Customer accounts settings.

Step 4: Add the Sign in with Shop button to your external sign-in page

If your store offers Shop Pay as a payment method, then you need to Add Sign in with Shop to your external sign-in page.

Customer sign-in experience

After you activate a new identity provider, signed in customers need to sign in again to your store using the new authentication service.

Both the email address and sub from the identity provider are used to identify customers. The sign-in flow for your customer depends on whether their email address matches an existing profile in the Customers page of your Shopify admin:

• If a customer profile with the email address exists on your store, then the customer is logged in to that account.
• If no customer profile exists for their email address, then a new customer account is created after the customer signs in successfully.

After a customer links to your identity provider, the sub is displayed as the subject id on the customer's profile.

Unlink a customer from your identity provider

If a customer's profile is linked to the wrong subject in your identity provider, you can unlink the customer from their customer profile in your Shopify admin. Customers affected by a mismatched subject id might encounter the error message The sign-in method you used doesn't match this account. when they try to sign in.

After you unlink a customer, the customer is signed out. They can sign back in with their existing credentials, and a new link between their customer profile and your identity provider is created on their next successful sign-in.

Unlinking removes only the connection between the customer and your identity provider. The customer's profile, orders, and other store data aren't affected.

Steps:

1. In your Shopify admin, open the Customers page.
2. Click the customer that you want to unlink.
3. In the customer details, click Unlink next to your identity provider's ID, such as Okta ID or Auth0 ID.
4. Review the subject id displayed in the confirmation dialog, and compare it to the subject id tied to this customer in your identity provider. If the subject ids don't match, then unlinking should resolve the The sign-in method you used doesn't match this account. error.
5. Click Unlink to confirm.

Revert back to Shopify as the default identity provider

You can change your identity provider back to the default customer sign-in experience at any time.

Steps:

1. From your Shopify admin, go to Settings > Customer accounts.

2. In the Identity provider section, click Manage.

3. In the Default identity provider drop-down menu, select Activate.

After you activate your default identity provider, an Active badge displays next to the default identity provider in the Identity provider section of your Customer accounts settings.

Managing customer data

If a customer requests that their personal information is removed from your Shopify store, then you can erase a customer's personal data from your Shopify admin.

If you've connected your own identity provider, then you also need to remove any relevant customer data from your provider dashboard. For more information, refer to your identity provider's documentation about customer data erasure.

Updating your identity provider when changing your customer accounts domain

If you plan to change your customer accounts domain to a different URL, then you'll need to update your identity provider settings before making the change in Shopify. This ensures customers can continue to sign in without interruption.

These steps are required when you update your customer accounts URL in Shopify from the legacy format, such as shopify.com/1234567890/account, to the new subdomain format account.your-store.com, or from an existing subdomain to a different subdomain, such as updating account.your-store.com to customers.your-store.com.

Add the new customer accounts subdomain to your identity provider

You'll add the new domain to your identity provider settings alongside your current domain. After you change the customer accounts domain in Shopify and confirm the customer accounts sign-in and sign-out process is working, then you can remove the old domain entries.

Steps:

1. Log in to your identity provider's admin console, such as Auth0 or Okta.
2. Locate the application you created for Shopify.
3. Find the Redirect URI field and add a new entry for your custom subdomain. For example: https://account.your-store.com/authentication/login/external/callback
4. Find the Sign-out URL field and add a new entry for your custom subdomain. For example: https://account.your-store.com/logout_callback
5. Save your changes in the identity provider. Keep both the old and new URLs for now.
6. Return to your Shopify admin and follow the steps to change your accounts domain to the new custom subdomain URL in Shopify.
7. Test both sign-in and sign-out on your storefront to confirm that everything works.
8. Optional: After the sign-in process is confirmed to work correctly, you can return to your identity provider and remove the old domain entries.

Common redirect URI field names by provider