The identity provider for Shopify

Descope connects to Shopify's customer accounts as your OpenID Connect (OIDC) identity provider. Once connected, Descope runs login for your storefront, letting you add passwordless auth, passkeys, MFA, and enterprise SSO, and customize the whole journey with no-code flows. Connecting an external identity provider to customer accounts is a Shopify Plus capability. 

Shopify deprecated legacy customer accounts as of February 26, 2026, and is directing all stores to its newer customer accounts. Shopify has said a final sunset date for legacy accounts will be announced later in 2026, so legacy stores keep working for now but should plan their move. New customer accounts replace the old password and Liquid-based login with passwordless sign-in, and rely on a connected OIDC provider for anything more advanced.

Multipass works only with legacy customer accounts and is not supported on Shopify's new customer accounts, so it effectively retires alongside legacy accounts. To keep single sign-on between your own site and your Shopify store, you connect a standards-based OIDC identity provider like Descope to customer accounts instead of relying on Multipass. 

Yes. Shopify's new customer accounts support advanced authentication only through a connected OIDC provider, and Descope is built to be that provider. With Descope you can offer magic links, passkeys, social login, and step-up MFA on your storefront without writing custom authentication code. 

Connecting your own OIDC identity provider to Shopify customer accounts is a Shopify Plus capability, and Multipass was Plus-only as well, so the storefront integration described here is aimed at Shopify Plus merchants. Descope can still power login for any other web or mobile apps you run alongside Shopify, regardless of plan. 

Descope offers an open-source Shopify migration tool that supports both bulk migration, from a Shopify CSV export or the Admin GraphQL API, and just-in-time migration on a customer's first login. It maps email and phone to login identifiers and carries over details like customer ID, lifetime spend, order count, and tags as custom attributes. 

No. Shopify does not export customer passwords, so migrated customers arrive in Descope with no stored credential and sign in passwordlessly with a magic link or passkey on their first visit. That removes the forced password reset that usually disrupts a migration and moves everyone onto stronger, phishing-resistant methods. 

Yes. Descope gives customers one identity across your Shopify storefront, websites, mobile apps, and sub-brands, so they are recognized everywhere you sell rather than holding a separate account per property. When those properties share a common domain, a customer who signs in on one can be signed in automatically on the others. 

Yes. The same platform that runs your Shopify login also secures AI agents and MCP servers through the Descope Agentic Identity Hub. You can give agents their own scoped, revocable identities and least-privilege access to your commerce APIs, so you are ready for agentic commerce without standing up a second identity system.