Customer Account API vs. a Custom Login System on Headless?
Shopify's Customer Account API is the login system for a headless storefront; building a parallel auth system wastes an estimated $75,000 to $200,000 (Deploi estimate, illustrative). The API authenticates buyers, not apps, and its 7,500 cost-point quota replenishes at 200 points per second on Plus, 100 below (verified Sep 2026). Legacy customer accounts closed to new stores on February 26, 2026, with the final sunset date still unannounced.
Your profile — see how the verdict shifts
- Confidence
- High — Read shopify.dev's Customer Account API reference on 2026-09-05: the API authenticates buyers, not apps, it limits each app to 7,500 cost points per store and customer, and that quota replenishes at either 100.0 or 200.0 cost points per second depending on plan. Read Shopify's changelog of February 26, 2026 the same day: legacy customer accounts are no longer available to new stores and existing stores not using them, merchants should switch to the Customer Account API as soon as possible, and a final sunset date will be announced later in 2026, with no date set as of this check. Checked whether the App Store has an identity or authentication category at all: Store management's only subcategories are Finances, Operations, Security and Support, none covering customer identity. Fetched Oxi: Social Login & Wishlist (4.9★, 106 reviews) as the closest named candidate; it works through theme app blocks on an Online Store 2.0 theme, which a Hydrogen storefront does not render, so it does not resolve this fork. Okta and OneLogin publish no Shopify App Store app. This decision is made in code, not by installing anything.
- Reference scenario
- $20M–$100M GMV · Shopify Plus · Hydrogen storefront on Oxygen · 60,000–400,000 customer accounts with order history and reorder in the account area · agency dev bench, no in-house identity team
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| New headless build, standard buyer accounts | WAIT | Wire the Customer Account API's OAuth flow into the storefront and stop. Login, order history and reorder arrive with the platform, and the integration is an estimated 2–5 weeks (Deploi estimate, illustrative), not a project. |
| Plus with an enterprise or membership identity provider | CUSTOMIZE | Connect the identity provider you already license as a custom identity provider on new customer accounts, a Plus capability, and let Shopify keep issuing the buyer session. Federation is glue; a second password store is a liability. |
| Heavy account area: order history, reorder, subscriptions, B2B | CUSTOMIZE | The 7,500 cost-point quota per store and customer, replenishing at 200 points per second on Plus (verified Sep 2026), is where a chatty account page runs out of room. Budget an estimated $6,000–$18,000 for caching and query discipline (Deploi estimate, illustrative). |
| Identity is a system of record outside commerce | BUILD | A membership, licensing or practitioner registry that must stay authoritative keeps its own directory and federates into Shopify. Even then, Shopify still issues the storefront session, so the build is a bridge worth an estimated $40,000–$120,000 (Deploi estimate, illustrative), not a replacement auth stack. |
What Customer Account API vs. Custom Auth Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Customer experience | High | Login is the gate in front of order history, reorder and B2B pricing; a session that drops or a password reset loop costs the order that was already in the cart. |
| Operational efficiency | High | Shopify owning credentials, recovery and bot defense removes an entire on-call surface from the team, which is worth more than the build savings on any three-year view. |
| Retention & LTV | Medium | Reorder from order history is the repeat-purchase path for consumables and B2B, and it only works when the account area loads inside the API's cost-point budget. |
| Data & insight | Medium | Keeping identity on Shopify keeps one customer profile with orders, consent and company context attached, rather than two systems that need reconciling before any analysis. |
| Revenue — indirect | Low | Authentication itself sells nothing; the revenue shows up through logged-in personalization, saved payment methods and reorder, all of which sit downstream of it. |
Spend ceiling: Cap authentication spend at the integration: an estimated $8,000–$25,000 to wire the Customer Account API into the storefront (Deploi estimate, illustrative). Anything beyond that belongs to the account area's features, not to login.
What buying enables (top apps)
- + OAuth buyer authentication that Shopify maintains, with credential storage, recovery and bot defense included at no charge (verified Sep 2026)
- + Order history, addresses, and B2B company and location context available to your own frontend through one API
- + Sign in with Shop and the passwordless login buyers already use on other Shopify stores
- + A Plus route to connect the identity provider you already license, without a second password store (verified Sep 2026)
What building additionally unlocks
- + An identity model Shopify's customer object cannot express, such as a licensing or practitioner registry that must stay authoritative
- + Session rules that outlive the platform's own, for kiosk, shared-device or long-lived B2B buyer sessions
- + Cross-property single sign-on where the storefront is one of several apps behind the same directory
Find Your Verdict in 3 Questions
Does your storefront need buyers to log in, see orders and manage addresses, the ordinary account job?
Yes: Go to question 2.
No: Your verdict: WAIT — skip accounts entirely for now; the Customer Account API is there the day a requirement appears, and nothing you build today makes that easier.
Do your buyers already authenticate somewhere else that must stay the system of record — a membership portal, intranet or licensing registry?
Yes: Your verdict: CUSTOMIZE — connect that identity provider as a custom identity provider on new customer accounts, a Plus capability, and let Shopify keep issuing the buyer session.
No: Go to question 3.
Does any requirement genuinely fall outside Shopify's customer model, meaning not branding and not the login screen's look, but the identity model itself?
Yes: Your verdict: BUILD — keep your directory authoritative, federate into Shopify, and budget the bridge at an estimated $40,000–$120,000 (Deploi estimate, illustrative).
No: Your verdict: WAIT — use the Customer Account API, spend the saved months on the account features buyers notice, and cache the order-history queries.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | The Customer Account API integration is an estimated 2–5 weeks of storefront work; a login system with its own password store, reset flows and session store runs 4–9 months (Deploi estimate, illustrative). | ||
| Recurring fees | Shopify charges nothing per login or per account on the Customer Account API (verified Sep 2026); a custom system adds an identity vendor bill or your own session infrastructure every month. | ||
| Maintenance & upgrades | Shopify versions the API and you follow it once a year; owned auth means patching a credential store forever, on someone's pager, at ~15–20% of build cost per year (Deploi estimate). | ||
| Switching & exit | Customer records stay on Shopify either way, so leaving the API means rewriting a storefront route; leaving a custom system means migrating hashed passwords nobody can re-hash and forcing a reset for every buyer. | ||
| Risk | |||
| Vendor risk | Shopify is already your commerce vendor, so the API adds no new counterparty; custom auth usually leans on an identity SaaS that becomes one, priced per monthly active user. | ||
| Security & compliance surface | Shopify owns credential storage, rotation, breach response and bot defense on the API; a custom login system makes your team the answer to every one of those questions. | ||
| Platform-deprecation exposure | The Customer Account API is the destination Shopify is steering to; the lane it replaced, legacy customer accounts, closed to new stores on February 26, 2026 with a sunset date still to be announced (verified Sep 2026). | ||
| Value | |||
| Fit to requirement | The API covers buyer login, order history, addresses and B2B company context; a bespoke system fits an unusual identity model, which is the only requirement it wins on. | ||
| Time to market | Weeks against months, and the months come before a single commerce feature ships to a buyer. | ||
| Performance & scale | The 7,500 cost-point quota per store and customer replenishes at 200 points per second on Plus and 100 below (verified Sep 2026), so account pages need query discipline and a cache at either tier. | ||
| Data ownership & AI-readiness | Customer records, orders and consent stay in Shopify and export from there under either lane; a parallel store fragments the profile across two systems that then need reconciling. | ||
| Focus & opportunity cost | Auth is undifferentiated work that no buyer thanks you for; every week spent on it is a week not spent on merchandising, speed or the account features people actually use. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Shopify Customer Account API | Native — First-party Shopify. Authenticates buyers, not apps, over OAuth, and limits each app to 7,500 cost points per store and customer; the quota replenishes at either 100.0 or 200.0 cost points per second depending on your plan, with Plus at the 200 rate (verified Sep 2026). Serves login, order history, addresses and B2B company context to a Hydrogen or fully custom storefront. | Included with the plan; no per-login or per-account charge (verified Sep 2026) | Every headless storefront that needs buyer login and an account area |
| Custom identity provider on new customer accounts | Native — First-party Shopify, Plus only. The supported way to let an identity provider you already license authenticate buyers while Shopify still issues the storefront session. Configured in Shopify and at the identity vendor rather than installed from the App Store; new customer accounts are the account system Shopify is investing in, and legacy accounts are deprecated (verified Sep 2026). | Included with Shopify Plus; the identity provider's own licensing is separate and quote-based (verified Sep 2026) | Federating a member, workforce or portal directory into Shopify accounts |
| Oxi: Social Login & Wishlist | Live — 4.9★, 106 reviews, Built for Shopify. Social login with Google One Tap, Apple Sign-in and Shop Login, plus a Custom Identity Provider option for Plus stores on its top tier. Oxi renders through theme app blocks on an Online Store 2.0 theme, which a Hydrogen storefront never loads, so it is the closest real building block rather than an answer to headless authentication. | Essential $2.99/month, Pro $5.99/month, Plus $14.99/month; no free plan, 7-day free trial on all plans (verified Sep 2026) | Social login on a themed Online Store, not on a headless storefront |
| Enterprise identity platforms | Category — Okta publishes no Okta SSO app on the Shopify App Store, and OneLogin has no listing either, both re-checked 2026-09-05. Identity platforms connect through the Plus custom identity provider route, configured with the vendor. They federate a directory you already run; none of them replaces the Customer Account API for issuing buyer sessions on a storefront. | Quote-based or per monthly-active-user with the identity vendor; pricing not listed on the App Store | Organizations whose members already log in somewhere else first |
The Build Path
- Customer Account API OAuth in the storefront: The bounded build, and the one to scope: an OAuth redirect, token exchange and refresh, a server-side session cookie, and account routes for orders, addresses and reorder. Shopify authenticates buyers, not apps (verified Sep 2026), so the storefront never holds a credential.
- A cache and query budget for the account area: Each app gets 7,500 cost points per store and customer, replenishing at 200 points per second on Plus and 100 below (verified Sep 2026). Order history with line items and images is the query that burns it. Cache per session, page the order list, and fetch line-item detail only on demand.
- Federation instead of a second password store: Where members arrive from a portal, intranet or membership platform, connect that identity provider as a custom identity provider on new customer accounts, a Plus capability. Shopify still issues the buyer session, so checkout, B2B company context and order history keep working without a mapping table you maintain.
- A full custom auth system, honestly priced: Credential storage, reset and recovery flows, session management, MFA, bot defense, breach response, and a mapping from your user IDs to Shopify customer IDs that must never drift. An estimated $75,000–$200,000 to build (Deploi estimate, illustrative), then permanent ownership, and checkout still needs a Shopify customer at the end of it.
- Effort band
- $8,000–$25,000 to wire the Customer Account API into a Hydrogen storefront, including the account area — Deploi estimate (illustrative); lands in the $10–25K contact-form band. A from-scratch login system runs $75,000–$200,000 (Deploi estimate, illustrative), which is the number this page exists to stop.
- Typical timeline
- 2–5 weeks for the Customer Account API integration; 4–9 months for a custom login system with its own credential store (Deploi estimate, illustrative)
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $1,500–$5,000/yr (Deploi estimate, illustrative) on the API path, covering one annual API version bump and account-route regression tests. Custom auth instead carries patching, rotation and incident response with no ceiling.
- What you own — and what you take on
- You own: the account UI, the session cache, the routes and the redirect behavior after login. You take on: an API version bump about once a year and a query budget on the account pages. Shopify keeps: credentials, password recovery, bot defense and breach response.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $8,000–$25,000 | $75,000–$200,000 |
| Years 1–3 (recurring) | $4,500–$15,000 (maintenance) | $68,000–$198,000 (upkeep plus identity SaaS) |
| 3-year total | ≈$12,500–$40,000 | ≈$143,000–$398,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Buy column = the Customer Account API path: OAuth integration, account routes and a session cache in a Hydrogen storefront, with no per-login platform fee.
- † Build column = a custom login system with its own credential store, MFA, recovery flows and a Shopify customer mapping, plus an identity SaaS bill at mid-volume; three-year horizon.
What the Sticker Price Hides
On the buy path
- — The 7,500 cost-point quota applies per store and customer (verified Sep 2026); an uncached order-history page throttles real customers before it throttles your test account
- — New customer accounts changed the login experience, so a design signed off against the old password screen needs re-approval before launch
- — Multipass works only with legacy customer accounts, deprecated since February 26, 2026 (verified Sep 2026), so any inherited Multipass handoff is a migration item, not a shortcut
- — The custom identity provider connection requires Shopify Plus (verified Sep 2026), which turns a federation requirement into a plan question below Plus
On the build path
- — $75,000–$200,000 to build (Deploi estimate, illustrative), and checkout still needs a Shopify customer record at the end of it
- — Credential storage makes your team responsible for rotation, MFA, bot defense and breach notification, permanently
- — Every buyer needs a forced password reset the day you migrate, because hashed passwords cannot be re-hashed into another system
- — A user-ID-to-customer-ID mapping table drifts silently, and the failure shows up as a buyer whose order history disappears
What Merchants Say
Teams scoping a first Hydrogen project routinely carry a custom authentication line item into the estimate, then delete it in week two once someone reads the Customer Account API docs.
The recurring regret on headless account areas is query cost, not login: order history pages built without caching hit the cost-point quota on real customers with hundreds of orders.
If You Change Your Mind Later
If you bought and outgrow it
Nothing is stranded on the Customer Account API path: customer records, orders and consent already live in Shopify, so leaving means rewriting storefront routes rather than migrating people. The account area is a few weeks of work in either direction, which is exactly why it should not be a project.
If you built and want out
Retreating from a custom login system is the expensive exit: hashed passwords cannot move, so every buyer gets a forced reset, and the sign-in rate drops for a month while people reset or churn. Keep Shopify customer IDs mapped from day one so the retreat is a routing change rather than a data recovery.
When This Answer Changes
We're watching for:
- ▸ Shopify announcing the final sunset date for legacy customer accounts, which the February 26, 2026 changelog says arrives later in 2026
- ▸ A change to the 7,500 cost-point quota or its 100 and 200 points-per-second replenishment rates, which would move the caching threshold
- ▸ The custom identity provider connection extending below Shopify Plus
Verdict change log:
- 2026-02-26Shopify deprecated legacy customer accounts: no longer available to new stores or existing stores not using them, with a direction to switch to the Customer Account API as soon as possible and a final sunset date to be announced later in 2026. That announcement removed the last defensible reason a headless team had to keep a Storefront API login flow or plan its own auth around one, and it is why this verdict is WAIT rather than a judgment call.
Common Questions
Does a headless Shopify storefront need its own login system?
No, a headless Shopify storefront does not need its own login system. Shopify's Customer Account API authenticates buyers over OAuth and returns order history, addresses and B2B company context to your own frontend (verified Sep 2026). Wiring it in takes an estimated 2 to 5 weeks (Deploi estimate, illustrative) against 4 to 9 months for a credential store you would then own forever.
What are the Customer Account API rate limits on Shopify Plus?
The Customer Account API limits each app to 7,500 cost points per store and customer, and that quota replenishes at either 100.0 or 200.0 cost points per second depending on your plan, with Plus at the 200 rate (verified Sep 2026). Account pages that load full order history with line items burn the quota fastest, so cache per session and page the order list.
Are legacy customer accounts still an option for a headless build?
No, legacy customer accounts are not an option for a new headless build. Shopify's changelog of February 26, 2026 states they are no longer available to new stores or existing stores not using them, and directs merchants to switch to the Customer Account API as soon as possible. A final sunset date will be announced later in 2026, with no date set as of September 2026.
Your Next Steps
If you're going with WAIT(matches your selected profile)
- Delete the custom authentication line item from the headless estimate and re-scope it as an OAuth integration
- Map the account area's queries and set a per-page cost budget against the 7,500-point quota
- Cache order history per session and page the list; fetch line-item detail only when a buyer opens an order
- Confirm the store is on new customer accounts, not legacy, before the storefront work starts
- Test login, refresh and logout against a customer with hundreds of orders, not a fresh test account
If you're going with BUILD
- Write down the identity requirement that Shopify's customer model genuinely cannot express, in one sentence
- Price credential storage, MFA, recovery, bot defense and incident response as ongoing owned work, not a build
- Check whether the custom identity provider route on Plus meets the requirement without a password store
- Map every internal user ID to a Shopify customer ID before launch, and reconcile it on a schedule
- Plan the forced-reset communication for launch day, because migrated password hashes never carry over
Official Docs & Sources
- Customer Account API — shopify.dev
- Legacy customer accounts are deprecated — shopify.dev
- New customer accounts — Shopify Help Center
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Build or Buy Observability for Checkout Functions on Shopify?
Shopify documents 12 function error types and stores each run in the Dev Dashboard, but no default alert tells you a checkout function has started failing.
Do Customer Accounts Follow Shoppers Across Plus Stores?
Each Plus store keeps its own customer records, so accounts don't follow shoppers between stores. Multipass rides legacy accounts Shopify deprecated.
Should You Build or Buy Cross-Store Staff Access on Plus?
Custom organization-level roles give one staff login reach across a Plus organization. No app grants staff access across stores; below Plus, every store is separate.
Function Input Query Limits: Redesign the Data or Buy an App?
Shopify caps a Function input query at 3,000 bytes excluding comments and a calculated query cost of 30, and drops metafield values above 10,000 bytes entirely.
Build or Buy Performance Monitoring & App Audits on Shopify?
Measurement is free on Shopify; storefront speed comes from an audit-and-remediation program, not a speed app.
Ready to scope headless accounts without a login project?
We wire the Customer Account API into Hydrogen storefronts, design the account area around its query budget, and federate the identity provider you already license when that is the real requirement.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.