Requirements for connecting your own identity provider to customer accounts

Before you connect your own identity provider to customer accounts, make sure that your provider meets all technical requirements by reviewing the documentation or contacting your identity provider for support.

Requirements for identity providers

To integrate with your Shopify store, the identity provider must meet the following requirements:

The identity provider supports the OAuth 2.0 authorization code flow. Implicit and hybrid flows aren't supported. client_secret_basic is the default token endpoint authentication method.
The identity provider supports the Proof Key for Code Exchange (PKCE) for public clients.
The identity provider is compliant with the OpenID Connect (OIDC) standard for authentication.
The identity provider supports OpenID Connect RP-Initiated Logout 1.0 for logout. Back-Channel and Front-Channel logout aren't supported.
The identity provider supports email as the unique identifier for users, and email verification is part of the registration process.

Endpoint requirements

The identity provider that you connect to must support specific endpoints. Review the following table to learn more about the required endpoints, their specifications, and examples.

Required identity provider endpoints
Required endpoint	Example domain and path	Specifications
Authorization	https://auth.provider.com/authorize	RFC 6749 Section 4.1
Token	https://auth.provider.com/token	RFC 6749 Section 4.1.3 and RFC 6749 Section 6
JWKS	https://auth.provider.com/.well-known/jwks.json	RFC 7517 Section 5
Discovery	https://auth.provider.com/.well-known/openid-configuration	OpenID Discovery 1.0

Endpoint response time requirements

Requests from Shopify to your identity provider's token, discovery, and userinfo endpoints must respond within 1 second. If an endpoint takes longer than 1 second to respond, the request will time out and the login flow will fail. To avoid timeouts, make sure that your identity provider is hosted in an environment with low latency and sufficient capacity.

Mobile requirements

If your store has a mobile app, then the identity provider's Authorization endpoint must support the following parameters:

code_challenge: Verifies that the client requesting the token is the same client that initiated the request.
code_challenge_method: This endpoint must be set to S256.

ID token requirements

An ID token is proof of authentication, issued by your identity provider after a user successfully logs in. Review the following claim and signatory requirements for ID tokens.

Required claims

Claims are statements that your identity provider shares about a user, which are used for authentication. When connecting customer accounts to your own identity provider, the following claims are required in the ID token setup:

sub: A unique identifier for the user within your identity provider.
nonce: A unique string included in the ID token to prevent replay attacks.
email: The user's unique email address used to provision the customer account. For Entra ID and Azure AD integrations, the upn claim is used instead of email, and must point to a valid email address that can receive order and customer-related communications.
email_verified: A boolean indicating whether the email has been verified by the identity provider. The value for email_verified must be true.
iss: The issuer identifier for your identity provider.
aud: The audience that the ID token is intended for, also known as your client ID.

Token signature requirements

Signatory requirements help your identity provider to verify the identity of a user during the sign-in process. Your identity provider must sign ID tokens using one of the following supported algorithms:

RSA: RS256, RS384, RS512
Elliptic Curve: ES256, ES384, ES512, ES256K
RSA-PSS: PS256, PS384, PS512
EdDSA: ED25519, EdDSA

Tokens signed with HS256 (HMAC with shared secret) aren't supported.

Session and token requirements

Shopify uses refresh tokens to maintain customer sessions for up to 90 days. Without a refresh token, sessions will end when the access token from your identity provider expires, which is typically 1 hour.

To support long-lived customer sessions, your identity provider must meet the following requirements:

The identity provider must support issuing refresh tokens as defined in RFC 6749 Section 1.5.
The identity provider must be configured to return refresh tokens in the token response.

Additional resources

To learn more about OpenID Connect (OIDC) compliant identity providers and requirements, review the following third-party resources: