Shopify Legacy Customer Accounts and Where Auth0 Fits In

Shopify deprecated legacy customer accounts on 26 February 2026. If your store still runs the old email and password login, nothing has broken and nothing will break tomorrow. But the route most brands use to put a custom login in front of Shopify now leads somewhere that is being retired, and the replacement has a plan requirement that decides the whole conversation. Here is what actually changed and where an identity provider like Auth0 fits.

What Shopify actually changed

Two things, at different times, and they get conflated.

First, the naming. In December 2024 Shopify renamed both versions. "New customer accounts is now customer accounts" and "Classic customer accounts is now legacy customer accounts." So when documentation says customer accounts with no qualifier, it means the modern version.

Second, the deprecation. On 26 February 2026 Shopify deprecated legacy customer accounts. Legacy is no longer available to new stores or to existing stores not already using it, and Shopify will stop providing feature updates and technical support for it.

The practical difference between the two versions is how a customer signs in. Legacy uses email and password with Liquid templates you control. Customer accounts are passwordless: the customer enters an email address and receives a one-time six digit code. No password is required.

What deprecated means here, and what it does not

This is where most coverage overreaches, so be precise about it.

Deprecated does not mean switched off. Existing stores using legacy accounts continue to work. What stops is new access, feature development and support.

And there is no removal date. Shopify's announcement states that "A final sunset date for legacy customer accounts will be announced later in 2026." As of writing, that date has not been published. If somebody quotes you a specific legacy shutdown date, ask them for the source, because Shopify has not given one.

What Shopify does say is unambiguous in direction: "We strongly recommend that merchants upgrade their customer accounts ahead of the deadline." Theme developers are told to remove legacy Liquid files, app developers to move to customer account UI extensions, and custom storefronts to use the Customer Account API.

So this is a planning problem this quarter, not an emergency this week. The reason to start now is that authentication migrations touch every logged-in customer you have, and those are not projects you want to compress.

Why this matters beyond the login page

Merchants tend to think of this as a login screen. It is broader than that.

Your customer account area is where order history, addresses, returns and store credit live. If you built a custom account experience on legacy Liquid templates, that work sits on a deprecated foundation. Any app that hooks into the account area needs to be compatible with customer account UI extensions rather than legacy templates. And if you run a headless storefront, your authentication path is the Customer Account API rather than anything you build yourself.

There is also a branding consequence people notice late. Passwordless one-time codes are a different experience from a password field, and the account pages are Shopify-hosted rather than fully yours. For most brands that is fine and arguably better. For some it is the entire reason they start looking at Auth0.

Can Shopify customer login be customized?

Partly, and the honest answer has three layers.

Natively. You can brand customer accounts, and you can extend the account area using customer account UI extensions. You do not control the authentication mechanism itself, which is Shopify's passwordless code flow.

Around it. With a headless build you control the entire front end and use the Customer Account API for authentication. That API uses OAuth 2.0, with confidential clients server side and Proof Key for Code Exchange for public clients. Shopify remains the identity provider. Our comparison of Hydrogen and Liquid covers when headless is worth it at all.

Replacing the identity provider. Shopify supports connecting your own OpenID Connect provider to customer accounts. This is the layer where Auth0 belongs, and it carries a hard requirement covered below.

Multipass is a dead end, and this is the important part

If you have researched custom Shopify login before, you have met Multipass. It lets a customer signed into an external site enter your Shopify store without signing in again, using a signed token. It is the mechanism most Auth0 and Shopify tutorials are built on.

Two facts make it the wrong foundation in 2026.

Multipass requires Shopify Plus. And Shopify's Multipass documentation states that "Multipass login is only available with legacy Customer accounts, which needs to be explicitly chosen from your Customer Accounts settings in Shopify admin before you can enable Multipass." The same page recommends "migrating to the new, recommended Customer accounts for better security."

Read that together with the deprecation. Multipass only works with the version Shopify has deprecated. Building a new custom authentication flow on Multipass today means building on the thing you are supposed to be migrating away from.

Multipass also has constraints worth knowing if you are already on it: tokens are valid for 15 minutes and single use, the remote_ip field is deprecated, it cannot be used with the wholesale channel, and it cannot log a customer between multiple Shopify stores without redirecting through an external site.

Where Auth0 genuinely fits

Here is the part that surprises people, including us when we checked. Connecting Auth0 is not a workaround. Shopify publishes an official provider guide for it.

The supported architecture looks like this. Your customer signs in through Auth0. Auth0 acts as the OpenID Connect identity provider. Shopify accepts that identity for customer accounts, creates or matches the customer record, and the rest of the store, cart, checkout and order history, continues to work as Shopify normally does.

Auth0 does not replace Shopify authentication. It replaces the part where Shopify decides who the customer is. Everything downstream is still Shopify.

The requirement that decides everything: this is Shopify Plus only. Shopify's documentation states that "Connecting your own identity provider is available only to stores on the Shopify Plus plan." If you are not on Plus, this architecture is not available at any budget, and the conversation becomes whether the requirement justifies a move to Plus.

What Shopify requires from your identity provider

Worth checking before scoping, because these rule things out.

• OAuth 2.0 authorization code flow. Implicit and hybrid flows are not supported.
• PKCE for public clients.
• OpenID Connect for authentication, and OIDC RP-Initiated Logout 1.0 for logout. Back-channel and front-channel logout are not supported.
• Authorization, token, JWKS and discovery endpoints.
• Required ID token claims: sub, nonce, email or upn for Azure, email_verified, iss and aud.
• Tokens signed with HS256 are not supported.
• A one second response budget. Requests from Shopify to your token, discovery and userinfo endpoints must respond within one second.

That last one deserves attention. A one second ceiling means an identity provider in a distant region, or a login action doing a database lookup against a slow internal system, can fail in production while working fine in testing.

The two things that break Auth0 implementations

Refresh tokens. This is the single most common failure and it is documented. Auth0 does not include a refresh token by default in the authorization code flow. Without one, the customer session ends when the access token expires, typically after about an hour, even though Shopify sessions can be valid for up to 90 days. The symptom is customers being logged out constantly for no apparent reason. The fix is adding offline_access to the additional scopes and enabling refresh token rotation in Auth0.

Claims and data sync. Shopify requests only openid and email by default. To bring across name, phone or address you add those scopes explicitly, and enable customer data sync in Shopify. Custom claims such as tags use an Auth0 Action on the Post Login trigger. Note that Auth0 Rules and Hooks are deprecated with end of life in November 2026, so anything built on those needs to be an Action instead.

When a brand actually needs this

Most do not, and we would rather say so than sell an architecture nobody needs.

It earns its cost when identity has to be shared across systems. A membership platform, a mobile app and a store that must recognise the same person. Enterprise buyers who expect single sign on. An existing identity infrastructure the store has to fit into rather than replace. Complex requirements such as enforced multi-factor authentication for a B2B buyer portal.

If your requirement is that the login page should match your brand, this is the wrong tool. That is a theming question with a far smaller budget attached.

What to review before you commit

• Which account version you are on today. Check Settings, Customer accounts, before assuming.
• Whether you are on Plus. The bring your own identity provider path requires it.
• Whether anything depends on Multipass. That path retires with legacy accounts.
• What customer data exists and where. Matching on email is the usual join, so duplicates and unverified addresses matter.
• Your identity provider's latency. Against the one second budget, measured from Shopify's perspective.
• A rollback plan. Authentication is the one system where a bad deploy locks out every customer at once.

Is there a deadline to move off legacy customer accounts?

Not a published one. Shopify's deprecation notice from 26 February 2026 says a final sunset date "will be announced later in 2026" and that date has not appeared yet. Legacy accounts still function for stores already using them. Treat it as planned work rather than an emergency, and be sceptical of anyone quoting a specific shutdown date.

Can Auth0 be used with Shopify?

Yes, and it is officially supported. Shopify publishes an Auth0 provider guide for connecting your own OpenID Connect identity provider to customer accounts. The requirement is a Shopify Plus plan with customer accounts enabled and an Auth0 tenant configured as a regular web application.

Do I need Shopify Plus for custom authentication?

For connecting your own identity provider, yes. Shopify states it is available only on Plus. On other plans you can brand customer accounts and extend the account area with UI extensions, but the authentication mechanism itself stays Shopify's.

Why do customers get logged out after an hour?

Almost always missing refresh tokens. Auth0 does not issue one by default in the authorization code flow, so the session dies when the access token expires even though Shopify sessions can last up to 90 days. Add offline_access to your additional scopes and turn on refresh token rotation.

Does Multipass still work?

It works today on Shopify Plus stores using legacy customer accounts, and only there. Since legacy accounts are deprecated, Multipass is not a foundation to build anything new on. Shopify's own documentation recommends migrating to customer accounts.

Will migrating make customers reset their passwords?

There are no passwords to reset. Customer accounts are passwordless, using a one-time six digit code sent to the customer's email. This removes password reset support tickets entirely, but it is a genuine change in experience and worth communicating before you switch rather than after.

Talk to us about your authentication setup

Free architecture review. Email hello@exactwhy.com with subject "Customer accounts" and tell us which account version you run, whether you are on Plus, and whether anything currently depends on Multipass. We respond within 4 hours with what your realistic options are. For a lot of stores the answer is a straightforward upgrade with no identity provider involved, and we will tell you that.

Paid implementation, Rs 50,000 to Rs 1.5 lakh. Review of your current architecture, migration planning off legacy accounts, identity provider integration where it is justified, claims and data sync, and full testing of the flow including expiry and logout paths before anything reaches customers.

Ongoing Shopify development, Rs 20,000 to Rs 50,000 a month. Including watching for the sunset date announcement, which has not been made yet and will matter when it is.

The mistake we expect to see most over the next year is brands building a custom login on Multipass because a tutorial from 2023 said to. It works, right up until it does not.