Shopify Plus Multipass review
Existing Multipass code checked, moved server-side, secret rotated, and redirects tested on legacy and new accounts.
The Problem
Your Customers Sign In Twice Before They Can Buy Anything
It shows up when a brand runs a member site, an app, or a portal next to its Shopify store, and each one keeps its own login.
01 · Double login
Members sign in on your site, then again at your store.
One identity provider or Multipass token carries them into Shopify already signed in.
02 · Old token code
Multipass code written years ago that nobody has checked since.
Token code is reviewed, moved server-side, and tested on new customer accounts.
03 · Exposed secret
The Multipass secret sits in a file several people read.
The secret moves to a vault, and a rotation plan replaces the old one.
04 · Open admin access
Departed staff keep admin access until someone removes them.
SAML and SCIM tie admin access to your identity provider, so offboarding removes it.
A member signs in to your course platform, clicks Shop, and meets a second login screen. They try an old password, request a code, and leave with an empty cart. Your Multipass code was written years ago, its secret sits in a config file three people can read, and nobody knows whether it works with new customer accounts. Meanwhile staff reach the Shopify admin with separate passwords, so when someone leaves, their access stays open until a person remembers.
We start by sorting your logins into two jobs: customer sign-in and staff access. Existing Multipass setups get their token code moved server-side, their secret rotated, and their redirects tested on new customer accounts. New customer SSO goes through Shopify's recommended route, your own OpenID Connect provider. Staff sign in through SAML with Okta or Entra ID. One login carries people where they need to go, not two.
Customer and staff kept apart
Customer sign-in and admin access use different Shopify features, so we plan each one separately.
Secrets kept on the server
Multipass tokens are minted on your server, and the shared secret stays out of the browser.
One login, tested everywhere
Store, checkout, account pages, and your app all tested with each type of user before launch.
Our Multipass and SSO Process
From Free Login Review to Single Sign-On in Five Steps
You approve which sign-in route each user type takes and how existing accounts match, then try every login yourself on a test setup before launch.
We look at your Shopify plan, your customer account version, any existing Multipass code, and your identity provider. You get a plain answer on which route Shopify supports for your store today.
What's Included
What You Get With Shopify SSO
The right sign-in route for each user type, secure token code, your identity provider connected, every login tested, and a runbook for your team.
Compare Options
DeveloperLook vs an SSO App vs an In-House Developer
An SSO app or your own developer can handle a simple case well. Here's where each holds up once customers, staff, and apps share one sign-in.
| Feature | DeveloperLookBest fit | SSO app | In-house developer |
|---|---|---|---|
| Time to start | 1 to 6 weeks | Same day | Depends on their backlog |
| Upfront cost | From $800, fixed | Monthly app fee | Their salary time |
| Route choice | Multipass, OpenID Connect, or SAML | The app's own method | Whatever they know best |
| New customer accounts | Tested on both versions | Check the app's support | Often untested |
| Secret handling | Server-side, with a rotation plan | Held by the app vendor | Varies by developer |
| Staff SSO | SAML and SCIM through Plus | Usually customer login only | A separate project |
| Testing | Every user type, store and checkout | Basic login test | Varies |
| Ongoing cost | None from us | Monthly fee | Their ongoing upkeep |
DeveloperLook
SSO app
- Time to start
- DeveloperLook: 1 to 6 weeksSSO app: Same day
- Upfront cost
- DeveloperLook: From $800, fixedSSO app: Monthly app fee
- Route choice
- DeveloperLook: Multipass, OpenID Connect, or SAMLSSO app: The app's own method
- New customer accounts
- DeveloperLook: Tested on both versionsSSO app: Check the app's support
- Secret handling
- DeveloperLook: Server-side, with a rotation planSSO app: Held by the app vendor
- Staff SSO
- DeveloperLook: SAML and SCIM through PlusSSO app: Usually customer login only
- Testing
- DeveloperLook: Every user type, store and checkoutSSO app: Basic login test
- Ongoing cost
- DeveloperLook: None from usSSO app: Monthly fee
Projects We've Built
Membership and Store Projects We Have Built
Membership sites, learning platforms, and shopping apps our team designed and built: the kinds of products whose logins a Shopify store often needs to share.
StriveGym Membership Website Design & Development
- Fitness & Gym
- Membership Platform
- Website
Gradely E-Learning Website Design & Development
- Education
- Dashboard
- Membership Platform
Unicom Fashion Ecommerce App and Admin Dashboard
- Fashion
- Dashboard
- E-commerce
SteelFit Gym Membership App Design & Development
- Fitness & Gym
- Membership Platform
- Booking System
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built online stores, member platforms, and integrations for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Plus Teams Trust Us With Their Login Setup
Sign-in decides who can buy, who can see orders, and who can change your store. These habits keep each of those under your control.
Shopify's supported route first
Shopify no longer offers Multipass to new stores and points new builds to your own identity provider. If that route covers your case, we'll tell you before quoting custom code.
Secrets stay server-side
A Multipass secret can sign in any customer on your store. We keep it on your server, and if it ever leaks, we revoke it and issue a new one.
Short-lived tokens
Shopify accepts each Multipass token once, within 15 minutes of its timestamp. We mint tokens at the moment of the click, so stale links fail safely.
Email decides the account
Shopify treats email as the unique customer key, and a clash causes an error. We match existing customers before launch, using identifiers where usernames differ.
Built for the account change
Shopify deprecated legacy customer accounts in 2026 and will announce a final sunset date. Any login work we do is tested on new customer accounts too.
Your provider, your control
Identity provider apps, secrets, and code live in your accounts and repository. Your IT team can rotate keys or remove users without calling us.
Overview
Who sets up Shopify Multipass and customer SSO for Plus stores?
DeveloperLook sets up and repairs Shopify Multipass for Plus stores, and builds the customer SSO Shopify now recommends instead: your own OpenID Connect identity provider. We also connect staff SSO through SAML with Okta or Entra ID. Work starts at $800 for one sign-in route, most projects finish in 1 to 6 weeks, and your keys remain yours.
DEVELOPERLOOK
Project facts · Shopify Multipass and Customer SSO
- Service
- Shopify Multipass and Customer SSO (Multipass, OpenID Connect, SAML for staff)
- Typical timeline
- 1 to 2 weeks for staff SSO or a Multipass fix, 4 to 6 weeks for headless SSO
- Platforms
- Shopify Plus with legacy or new customer accounts, Hydrogen, and headless
- Built with
- Multipass, OpenID Connect, SAML, SCIM, Customer Account API, Node.js
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 to 90 days, depending on plan
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $800 USD, fixed scope after a free login review
Reviewed 7 Oct 2026 by Saimul Islam
Good fit
Plus stores already on Multipass
Your store has used Multipass for years, and you need it checked, its secret rotated, and logins kept working on new customer accounts.
Brands with a member site or app
Your customers sign in to a course platform or app, and you want that one login to carry them into your Shopify store.
Plus stores starting customer SSO
You're starting customer SSO now, so you need the Shopify Multipass alternative Shopify recommends: your own OpenID Connect identity provider.
IT teams securing the admin
Your IT team wants staff to reach the Shopify admin through Okta or Entra ID, with access removed the day someone leaves.
Agencies with Plus clients
Your agency runs a Plus client's store and needs SSO configured, tested, and documented under your brand.
Not a fit
Not on Shopify Plus
You're not on Shopify Plus, so Multipass and a custom identity provider aren't options. Shopify's one-time code sign-in already spares your customers a password.
Account pages, not login
You want branded account pages and the move off legacy accounts, not single sign-on. Our Shopify Customer Accounts Customization page fits better.
Full headless build
You need a whole headless storefront built, not just its login. Our Headless Shopify Agency page covers the full build.
Budget under $800
Your budget is under $800 and you only need staff SSO with Okta or Entra ID. Shopify's automatic SAML setup for those providers may be enough.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for Multipass and Customer SSO
These are starting points in USD. Your final price depends on the sign-in routes you need and how many apps share them, and you get a fixed proposal after a free login review.
For one sign-in job: staff SAML with one provider, or a fix to existing Multipass.
$800one-time, USD
- Free login review
- Staff SAML SSO or a Multipass fix
- Identity provider app configured
- Test logins for each user type
- Written runbook
- 30 days post-launch support
Recommended
For Plus stores moving customer sign-in to their own identity provider.
$2,200one-time, USD
- Everything in Single Sign-In Job
- OpenID Connect provider for customer login
- Okta, Entra ID, Auth0, or Cognito set up
- Existing customers matched by email
- Login and logout tested at checkout
- 60 days post-launch support
For Hydrogen or headless stores and apps that share one customer login.
$4,700one-time, USD
- Everything in Customer SSO
- Customer Account API login for headless
- Login shared with your app or member site
- SCIM provisioning for staff
- Logout and session tests across apps
- 90 days post-launch support
For Agencies
White-Label Multipass and SSO Work for Agencies
You own the client relationship. We supply the sign-in work behind your retainer: Multipass fixes, customer identity providers, and staff SAML on your clients' Plus stores. Your client hears from your team, while the keys stay in their accounts.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the setup
Send the store, its Plus status, account version, and identity provider.
- Client needs
- You share the details
- Details received
We plan the route
A written sign-in plan and fixed quote come back for you to share.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Test and hand over
We test every login type and hand over a runbook under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Your name on the work
You present the login plan while we build it quietly.
Priced per sign-in route
Each route quoted before work begins, so your estimate holds.
Runbooks for your team
Secret rotation and offboarding steps written for your account managers.
Careful with keys
Senior developers who handle signing secrets and identity settings with care.
The Right Technology for Your Project
Technology Stack
Shopify's own sign-in features first: Multipass, customer identity providers, and SAML, with server code only where tokens or headless logins need it.
Shopify- Multipass
- Customer Account API
- Hydrogen
- Okta
- Auth0
- Microsoft Entra ID
Amazon Cognito
- OpenID Connect
- SAML 2.0
- SCIM
- OAuth 2.0 with PKCE
Node.js
Cloudflare- Postman
- Secrets vault
FAQ
Frequently Asked Questions
Straight answers on Multipass, identity providers, staff SAML, headless logins, cost, and timelines.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Multipass or SSO setup on Shopify starts at $800 for one sign-in job, such as a Multipass fix or staff SAML with one identity provider. Customer SSO through your own OpenID Connect provider costs $2,200. Headless logins shared with your app, plus SCIM for staff, cost $4,700. Each route needs Shopify Plus.
Staff SAML or a Multipass fix takes 1 to 2 weeks, including test logins for every user type. Customer SSO through your own identity provider takes 2 to 4 weeks, since existing customers must match first. Headless logins shared with an app take 4 to 6 weeks, and we switch over at a quiet hour.
Multipass is a Shopify Plus feature that signs a customer into your store with a token your own website creates. Your server encrypts the customer's email and details with the store's Multipass secret, then sends them to a Multipass login URL. Shopify signs them in and creates the account on the first visit if needed.
No, Shopify no longer offers Multipass to new stores, though Plus stores that already use it keep access. Shopify recommends that new integrations connect a third-party identity provider instead. A store that downgrades from Plus loses Multipass, so check your plan path before relying on it.
Multipass works with new customer accounts only for stores that already used it when Shopify added that support. For everyone else, Shopify says new builds should connect their own identity provider through OpenID Connect. That route supports current features, such as claim import, that Multipass lacks.
For customers, the Shopify Multipass alternative Shopify recommends is your own identity provider connected through OpenID Connect, on Shopify Plus. Shopify documents Okta, Microsoft Entra ID, Auth0, and Amazon Cognito, and other providers with the authorization code flow and PKCE can work. Customers who sign in this way can't change their email in their Shopify account.
A customer signs in on your site, and your server builds a JSON record with their email and a timestamp. It encrypts and signs that record with keys derived from the Multipass secret, then redirects the customer to the Multipass login URL. Shopify accepts each token once, within 15 minutes, and opens their session.
Yes, Okta can handle both, through two separate Shopify features. Staff sign in to the admin through SAML on a verified domain, and Okta is one of the providers Shopify sets up automatically. Customers sign in through Okta as an OpenID Connect provider, which Shopify allows on the Plus plan.
Shopify SAML SSO lets staff sign in to your Plus organization through your identity provider instead of a Shopify password. You verify your domain, connect Okta, OneLogin, Entra ID, or another SAML provider, then require it for all users or specific ones. Adding SCIM lets the provider create and deactivate staff accounts for you.
Yes, headless storefronts sign customers in through the Customer Account API, which uses OAuth with PKCE and Shopify's hosted login. Plus stores already on Multipass can exchange a Multipass token for a Customer Account API token. That grant has no refresh token, so your app mints a fresh Multipass token when the session expires.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.