Shopify Plus Multipass or a Modern SSO App?
Customizing wins for federated login on Shopify: connect your existing identity provider to new customer accounts, a Plus capability, and don't start a Multipass build in 2026. Multipass requires Plus and legacy customer accounts, which Shopify deprecated on February 26, 2026 with a final sunset date to be announced later in 2026 (verified Sep 2026). Tokens live 15 minutes and work once. No App Store app does enterprise SSO; the one purpose-built listing is delisted.
Your profile — see how the verdict shifts
- Confidence
- High — Read shopify.dev's Multipass reference on 2026-09-05: the store must be on a Shopify Plus plan, Multipass login is only available with legacy customer accounts, Shopify's own page says to consider migrating to the new customer accounts for better security, and each token is valid for 15 minutes and usable once. Read Shopify's changelog of February 26, 2026 the same day: legacy customer accounts are no longer available to new stores and existing stores not using them, merchants should switch to the Customer Account API as soon as possible, and a final sunset date will be announced later in 2026, with no date set as of this check. Browsed the App Store's Store management > Security > Accounts and login category: 24 apps covering B2B password locks, OTP and phone login, wholesale locks and account customizers, none mentioning SSO, SAML, Multipass or enterprise federation. The one listing matching the capability, SecurePie Single Sign On-SSO, is delisted, re-checked twice. Oxi: Social Login & Wishlist (4.9★, 106 reviews) is consumer social login with one line noting it works as a Custom Identity Provider for Plus stores on new customer accounts. Okta and OneLogin publish no Shopify app. The buy lane for enterprise SSO sits outside the App Store, at the identity provider you already license.
- Reference scenario
- $20M–$100M GMV · Shopify Plus · members arrive from a membership portal, intranet or loyalty platform with its own login · enterprise identity provider in place (Okta, Microsoft Entra ID, Auth0 or similar) · 20,000–200,000 customer accounts · agency dev bench
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Multipass integration live today | CUSTOMIZE | Your member login runs on an account system Shopify deprecated on February 26, 2026, with the sunset date still to be announced. Start the move to new customer accounts and a custom identity provider now, while you choose the cutover weekend instead of Shopify choosing it. |
| New federation project on Plus, identity provider in place | CUSTOMIZE | Connect the identity provider you already run as the custom identity provider for new customer accounts. The purchase happened years ago at the IdP; the work is the connection, the identity mapping and the account-area experience. |
| Not on Plus | WAIT | Neither Multipass nor a custom identity provider is available below Plus, and no app fills the gap. New customer accounts still give you passwordless login, Sign in with Shop and native Google and Facebook sign-in. Put the plan upgrade before the login project, or accept consumer login. |
| Consumer social login only (Google, Apple, Facebook), any plan | WAIT | New customer accounts cover Google and Facebook sign-in natively, with sessions that persist up to 365 days (verified Sep 2026). Add a social login app such as Oxi (4.9★, 106 reviews) only for providers Shopify doesn't offer, such as Apple. None of this is federation. |
What Multipass SSO Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Customer experience | High | A member who clicks through from the portal and is already signed in never sees a second login screen, which is the whole reason the federation project exists. |
| Revenue — indirect | Medium | Members who land signed in convert against their entitlements and saved details instead of abandoning at an account wall, and member-only pricing can render on first view. |
| Operational efficiency | Medium | One identity source of record ends the duplicate-account cleanup and the password-reset tickets that two login systems generate every week. |
| Data & insight | Medium | A stable join between the IdP identity and the Shopify customer makes member behavior reportable across the portal and the store without matching on names. |
Spend ceiling: Size the spend to the migration you'd otherwise do twice. A $15,000–$45,000 connection on new customer accounts (Deploi estimate, illustrative) is built once; a Multipass integration of similar size gets rebuilt before a sunset date Shopify has said is coming in 2026. Below Plus, spend nothing on federation until the plan is in place.
What buying enables (top apps)
- + Google, Apple, Facebook and other consumer providers live in an afternoon through a social login app such as Oxi (4.9★, 106 reviews, verified Sep 2026)
- + Vendor-maintained compatibility with new customer accounts as Shopify changes the sign-in surface
- + For Plus stores on new customer accounts, Oxi's listing notes it works as a Custom Identity Provider, a partial route for simple cases
What building additionally unlocks
- + System-to-system federation from your membership portal, intranet or loyalty platform, with members landing signed in
- + Your existing IdP's MFA and access policies applied to storefront login, with identity never copied into a login vendor's database
- + Member tiers and entitlements rendered inside customer account UI extensions on the account system Shopify is investing in
- + A one-time build, instead of a Multipass integration plus its forced migration before the legacy-accounts sunset
Find Your Verdict in 3 Questions
Do you have a Multipass integration running today?
Yes: Your verdict: CUSTOMIZE — start the migration to new customer accounts and a custom identity provider now; legacy accounts were deprecated on February 26, 2026 and the sunset date will be announced later this year.
No: Go to question 2.
Are you on Shopify Plus with an enterprise identity provider already in place?
Yes: Your verdict: CUSTOMIZE — connect the provider as the custom identity provider for new customer accounts and build the member experience in account extensions ($15,000–$45,000, Deploi estimate, illustrative).
No: Go to question 3.
Is the requirement consumer social login (Google, Apple, Facebook) rather than system-to-system federation?
Yes: Your verdict: WAIT — new customer accounts give you Google and Facebook sign-in natively; add a social login app only for providers Shopify doesn't offer.
No: Your verdict: WAIT — federation needs Plus's custom identity provider and no app substitutes below Plus; schedule the plan upgrade ahead of the login project.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | No App Store app installs enterprise SSO, so the app lane has no install to price; the IdP connection, identity mapping and account-area work run 4–10 weeks (Deploi estimate, illustrative). | ||
| Recurring fees | The identity provider is a license you already pay, quote-based and outside Shopify billing; the connection itself adds upkeep only, and new customer accounts are included with the plan. | ||
| Maintenance & upgrades | A Multipass integration carries a forced migration before the legacy-accounts sunset; a custom identity provider connection rides Shopify's supported account system and needs only IdP certificate rotations and API version bumps. | ||
| Switching & exit | Multipass ends with legacy accounts, so its exit is mandatory and undated; an IdP connection can be swapped for another IdP without touching Shopify customer records. | ||
| Risk | |||
| Vendor risk | The one purpose-built SSO listing is delisted and the category has nothing else (verified Sep 2026); an enterprise IdP is a mature vendor, and the connection depends on Shopify keeping the custom identity provider capability on Plus. | ||
| Security & compliance surface | Shopify's own Multipass page recommends the new customer accounts for better security; a Multipass token is a shared secret minted by your server and valid for 15 minutes, while the IdP connection uses the provider's standard flow with your existing MFA policies. | ||
| Platform-deprecation exposure | Multipass works only with legacy customer accounts, deprecated February 26, 2026 with a sunset date to be announced later in 2026 (verified Sep 2026); new customer accounts and the Customer Account API are the surfaces Shopify tells merchants to move to. | ||
| Value | |||
| Fit to requirement | A member who lands in Shopify already signed in is exactly what the IdP connection delivers; consumer social login apps deliver Google and Apple buttons, which is a different requirement. | ||
| Time to market | A Multipass integration is a known two-to-four-week pattern that now ends in a migration; the IdP connection takes 4–10 weeks once and stays. | ||
| Performance & scale | The Customer Account API limits each app to 7,500 cost points per store and customer, replenishing at 100 or 200 points per second by plan (verified Sep 2026), which is ample for account-area extensions and a constraint to design around. | ||
| Data ownership & AI-readiness | Identity stays in your IdP and the customer record stays in Shopify, joined by email; nothing about who your members are moves into a third-party login vendor's database. | ||
| Focus & opportunity cost | Federated login is plumbing nobody praises, and it's plumbing you'll be forced to redo if you lay it on Multipass now; doing it once on the supported surface is the cheaper distraction. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Shopify new customer accounts + custom identity provider | Native — First-party Shopify. New customer accounts are passwordless by default with a one-time 6-digit email code, support Sign in with Shop with passkeys, offer Google and Facebook sign-in natively, and keep sessions for up to 365 days. Plus stores can connect a custom identity provider, which is the supported route for system-to-system federation (verified Sep 2026). | Included with the plan; the custom identity provider connection requires Shopify Plus (verified Sep 2026) | Federating an enterprise or membership identity provider into Shopify on the account system Shopify is investing in |
| Shopify Multipass | Legacy — First-party Shopify, Plus only, and available only with legacy customer accounts, which Shopify deprecated on February 26, 2026: no longer available to new stores or existing stores not using them, with a final sunset date to be announced later in 2026. Tokens are valid for 15 minutes and usable once. Shopify's own page says to consider migrating to the new customer accounts for better security (verified Sep 2026). | Included with Shopify Plus (verified Sep 2026) | Keeping an existing integration alive while its replacement is built, and nothing new |
| SecurePie Single Sign On-SSO | Delisted — The one App Store listing purpose-built for this capability. The listing states the app is not currently available on the Shopify App Store, re-checked twice on 2026-09-05. There is no App Store route to enterprise SSO today, which is worth knowing before a week of searching. | Not available; listing delisted | Noting the absence, so the search for an SSO app ends sooner |
| Oxi: Social Login & Wishlist | Live — 4.9★, 106 reviews, Built for Shopify. Social login with Google One Tap, Apple Sign-in and Shop Login, plus a Custom Identity Provider option for Plus stores on its top tier. Oxi renders through theme app blocks on an Online Store 2.0 theme, which a Hydrogen storefront never loads, so it is the closest real building block rather than an answer to headless authentication. | Essential $2.99/month, Pro $5.99/month, Plus $14.99/month; no free plan, 7-day free trial on all plans (verified Sep 2026) | Adding Apple and other consumer providers that new customer accounts don't offer natively |
| Enterprise identity providers (Okta, Microsoft Entra ID, Auth0, OneLogin) | Category — Platform integration; no App Store listing. Okta and OneLogin publish no Shopify app (verified Sep 2026). The SSO purchase happens at the identity provider, usually years before the Shopify project, and the provider connects to Shopify as the custom identity provider for new customer accounts on Plus or, for stores still on legacy accounts, through Multipass. | Quote-based enterprise licensing, usually already in place; not an App Store charge | The identity source of record your members already log in to |
The Build Path
- Connect the identity provider you already run: On Plus, configure your IdP as the custom identity provider for new customer accounts, so a member who clicks through from the portal signs in with the provider and lands in their Shopify account. Map the IdP identity to the Shopify customer by verified email, and decide what happens to a member with no Shopify record yet. Confirm your provider's OpenID Connect configuration against Shopify's customer accounts help before scoping.
- Migrate off Multipass in sequence, not in a hurry: Inventory every system that mints Multipass tokens: the portal, the loyalty platform, marketing links. Stand up the IdP connection on new customer accounts, switch the portal's login link, then retire the token endpoint. Sequence it now, because the sunset date will be announced later in 2026 and the migration is the same size whether you choose the weekend or Shopify does.
- Own the account area with extensions: Member tiers, entitlements and portal links belong in customer account UI extensions, which render inside new customer accounts. Read member data through the Customer Account API, which authenticates buyers rather than apps and limits each app to 7,500 cost points per store and customer, so cache what the portal already knows.
- Effort band
- $15,000–$45,000 for the IdP connection, identity mapping, the Multipass cutover and account-area extensions — Deploi estimate (illustrative); lands in the $10–25K contact-form band for a clean IdP connection, $25–75K when a live Multipass integration and member entitlements have to move with it
- Typical timeline
- 4–10 weeks, with the IdP connection testable in the first three (Deploi estimate, illustrative)
- Maintenance, honestly
- ~15–20% of build cost per year (Deploi estimate): roughly $2,500–$9,000/yr (Deploi estimate, illustrative) covering IdP certificate rotations, changes to member entitlements, and moving extensions forward before an API version sunsets on Shopify's 12-month support window.
- What you own — and what you take on
- You own: the identity mapping, the member experience inside customer accounts, and the freedom to swap identity providers without touching Shopify customer records. You take on: the Plus subscription the custom identity provider requires, and the cutover from any Multipass flow still running.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $12,000–$25,000 (Multipass integration, Plus and legacy accounts required) | $15,000–$45,000 |
| Years 1–3 (recurring) | $20,000–$42,000 (forced migration before sunset, plus upkeep) | $7,500–$27,000 (upkeep) |
| 3-year total | ≈$32,000–$67,000 | ≈$22,500–$72,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Left column is the Multipass lane, the mechanism a merchant would otherwise build into today: a $12,000–$25,000 integration now plus a $15,000–$30,000 forced migration to new customer accounts before the legacy-accounts sunset (Deploi estimate, illustrative). No App Store app exists to price instead.
- † Right column is the CUSTOMIZE lane: the IdP connection on new customer accounts, identity mapping and account-area extensions, built once; three-year horizon. The identity provider's own license is excluded from both columns because you already pay it.
What the Sticker Price Hides
On the buy path
- — The only purpose-built SSO listing is delisted and the Accounts and login category's 24 apps contain no SSO, SAML or Multipass mention, so a week of App Store searching finds nothing (verified Sep 2026)
- — Consumer social login apps connect Google and Apple in minutes and are not federation; a membership portal or intranet needs a custom identity provider, which those apps only touch on Plus
- — Enterprise IdP fees never appear on the Shopify bill, so a login project's real recurring cost lives in a contract someone else in the company owns
- — A Multipass build quoted today is two projects: the integration, then its migration before a sunset date Shopify hasn't announced
On the build path
- — The custom identity provider connection requires Plus, so a non-Plus merchant's first cost is the plan, which starts at $2,300 USD/month (verified Sep 2026)
- — Members with no Shopify customer record yet need an explicit first-login path, or federation creates duplicate accounts by the hundred
- — The Customer Account API's 7,500 cost points per store and customer is generous for account pages and tight for anything that polls (verified Sep 2026)
- — ~$2,500–$9,000/yr upkeep for certificate rotations, entitlement changes and API version bumps (Deploi estimate, illustrative)
What Merchants Say
Plus merchants with a Multipass integration describe learning about the legacy-accounts deprecation from an admin banner, then discovering that their membership portal's one-click login depends on the account system being retired.
Low-star reviews on login apps cluster on the gap between the listing and enterprise needs: consumer providers connect in minutes, then a request for SAML or Active Directory federation gets a not-supported reply.
If You Change Your Mind Later
If you bought and outgrow it
There is no App Store SSO app to exit. If you build on Multipass, the exit is mandatory and undated: legacy customer accounts are deprecated with a final sunset date to be announced later in 2026, and the Multipass token endpoint dies with them. Every month on Multipass is a month closer to a migration you'll do on Shopify's schedule rather than yours, so write the migration plan before the integration ships.
If you built and want out
Nothing strands. Customer records stay in Shopify, identity stays in your provider, and the connection between them can be re-pointed at a different IdP without a customer noticing. If Shopify later ships a richer federation surface, you adopt it from the account system it's built on. The exit cost is the connection itself, which is days of work.
When This Answer Changes
We're watching for:
- ▸ Shopify announcing the final sunset date for legacy customer accounts, expected later in 2026, which turns every remaining Multipass integration into a dated deadline
- ▸ Shopify documenting a Multipass equivalent on new customer accounts or the Customer Account API, which would reopen a first-party token lane
- ▸ A purpose-built SSO app returning to the App Store and passing about 30 reviews, which would give the buy lane its first real option
Verdict change log:
- 2026-02-26Shopify deprecated legacy customer accounts: no longer available to new stores or existing stores not using them, with a final sunset date to be announced later in 2026 and a direction to switch to the Customer Account API as soon as possible. Multipass works only with legacy accounts, so the announcement turned every Multipass build from a Plus feature into a migration project, and this page's verdict with it.
Common Questions
Is Shopify Multipass being deprecated?
Multipass has no sunset date of its own, but it only works with legacy customer accounts, which Shopify deprecated on February 26, 2026. Legacy accounts are no longer available to new stores or existing stores not using them, and a final sunset date will be announced later in 2026 (verified Sep 2026). Multipass also requires Shopify Plus, and each token is valid for 15 minutes and usable once. Treat any Multipass build as temporary.
Is there a Shopify app for enterprise SSO with Okta, Entra ID or SAML?
No. The App Store's Accounts and login category held 24 apps on 2026-09-05, covering password locks, OTP login and account customizers, with none mentioning SSO, SAML, Multipass or enterprise federation. The one purpose-built listing, SecurePie Single Sign On-SSO, is delisted. Okta and OneLogin publish no Shopify app. Enterprise SSO connects from the identity provider's side, as the custom identity provider for new customer accounts on Shopify Plus.
How do I federate login into Shopify without Multipass?
Connect your identity provider as the custom identity provider for new customer accounts, a Shopify Plus capability, so members arriving from your portal sign in through the provider and land in their Shopify account. New customer accounts are passwordless by default, offer Google and Facebook sign-in natively, and keep sessions up to 365 days (verified Sep 2026). The connection, identity mapping and account-area extensions run $15,000–$45,000 (Deploi estimate, illustrative).
Your Next Steps
If you're going with CUSTOMIZE(matches your selected profile)
- Inventory every system that mints Multipass tokens or links members into Shopify, and who owns each
- Confirm your identity provider's OpenID Connect configuration against Shopify's custom identity provider requirements on Plus
- Define the identity mapping rule by verified email and the first-login path for members with no Shopify record
- Stand up the connection on new customer accounts, test with a member cohort, then switch the portal's login link
- Retire the Multipass endpoint and diary a check for Shopify's sunset-date announcement later in 2026
If you're going with WAIT
- Turn on new customer accounts with Google and Facebook sign-in and Sign in with Shop
- Add a social login app only for a provider your members actually ask for, such as Apple
- If enterprise federation is the real need, cost the Plus upgrade before scoping any login work
- Do not start a Multipass build; the account system it depends on is deprecated with a sunset date pending
- Revisit when Shopify announces the legacy-accounts sunset date or a federation surface below Plus
Official Docs & Sources
- Multipass (shopify.dev) — shopify.dev
- Changelog: legacy customer accounts are deprecated — shopify.dev
- New customer accounts — Shopify Help Center
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Will Your Apps Survive a Move to Hydrogen?
Reviews, upsell and personalization apps that render through theme app extensions have nowhere to go on a Hydrogen storefront, because there is no Liquid theme.
Should You Run Hydrogen and Your Theme in Parallel?
Hydrogen and an Online Store 2.0 theme can run against one catalog and cart. Shopify documents the compatibility; the routing layer between them is yours to build.
Plus's 100 Themes vs. a Multi-Tenant CMS for Sub-Brands?
Plus allows up to 100 themes per account, so theme count rarely decides anything. What decides sub-brand storefront architecture is who maintains the divergence.
Should You Go Headless on Shopify or Stay on Your Theme?
A headless storefront pays off for a small minority of mid-market Shopify merchants; a well-built theme delivers most of the gains without the replatform.
Build or Buy Performance Monitoring & App Audits on Shopify?
Measurement is free on Shopify; storefront speed comes from an audit-and-remediation program, not a speed app.
Ready to move member login off a deprecated API?
We connect your identity provider to new customer accounts on Plus, map members to their Shopify records without duplicates, and sequence the Multipass cutover so nobody sees a password reset.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.