Search Results :

×
Sign Up Contact Us

Contents

How to configure OAuth SSO in Shopify using AWS Cognito as an Identity Provider?

miniOrange allows AWS Cognito to act as an IDP (Identity Provider), which allows users to Single Sign-On (SSO) into Shopify using AWS Cognito Credentials. Our application is compatible with all the SAML / OAuth-compliant Identity Providers. We will go through a step-by-step guide to configure Single Sign-On (SSO) into Shopify using AWS Cognito as IdP (Identity Provider) and Shopify store as SP (Service Provider).

Shopify Cognito SSO - download plugin button Download Application Shopify Cognito SSO - plugin pricing button Shopify Cognito SSO - plugin pricing button Pricing Plans

Configure [OAuth] SSO into Shopify using Cognito User Store as IdP

To set up Single Sign-On (SSO) with Shopify via the OAuth protocol using Cognito user store as an identity provider (IdP), follow the steps outlined here.

To configure SSO into Shopify with AWS Cognito as IDP, you will need to install the miniOrange Shopify Single Sign On - SSO Login application on your store.

Youtube-color Created with Sketch.

Check out our video, to learn more about how Shopify SSO application works in Shopify.


Setup guide for Configuring AWS Cognito as IDP for SSO into Shopify

  • Go to your Shopify store and navigate to the App section and click on Single Sign On - SSO login application.
Shopify Cognito SSO - navigate to Shopify SSO App

  • Click on the Add Identity Provider button to add your IDP.
Shopify Cognito SSO - Add Identity Provider

  • Select OAuth 2.0 protocol.
Shopify Cognito SSO - Select OAuth 2.0 Protocol

  • Now choose AWS Cognito from the list of IDPs.
Shopify Cognito SSO - Choose AWS Cognito as IDP

  • Copy the OAuth Callback URL and keep it handy as it will be used in further steps.
Copy Callback URL from SSO App

  • Go to Amazon Console and sign up/log in to your account to Configure AWS Cognito.
Shopify Cognito SSO - Login to your AWS Cognito Application

  • Search for Cognito in the AWS Services search bar as shown below.
Shopify Cognito SSO - Search Cognito in App Services

Note and Contact Us - SSO between two WordPress sites

Note: If you already have a User Pool then follow the steps provided here, else follow the steps provided below.


  • Click on Create a User Pool button to create a new User Pool.
Shopify Cognito SSO - Create User Pool

  • Select the Application type as a Traditional web application. Provide a name for your application and choose the attributes in your user pool to be used during the sign-in process. Select the attributes that you require during the sign-up process from the Required attributes for the sign-up section.
Shopify Cognito SSO - Provide User Pool Details

  • Paste the Callback URL that has been copied from Step 1 in the Return URL field under the Add a Return URL section. Click on the Create button.
Shopify Cognito SSO - Paste Callback URL

  • Scroll down and click on the Go to Overview button.
Shopify Cognito SSO - Click on Go to Overview button

  • To configure how your user pool sends email messages to users, navigate to the Authentication methods under the Authentication tab and click on Edit under the Email section.
Shopify Cognito SSO - Navigate to Authentication Tab

  • Here, you can add the email address that your user pool will use to send emails to users. Click on Save Changes.
Shopify Cognito SSO - Provide Email to Send message

  • Navigate to the App Clients tab under the Applications section, and select your App Client. If you don't have an app client, then click on Create app client button.
Shopify Cognito SSO - Navigate to App Client Section

  • Copy the Client ID and Client Secret and keep them handy as they will be used in further steps.
Shopify Cognito SSO - Copy Client ID and Secret

  • Go to the Attribute permissions tab. Click on the Edit and select the attributes that you want during the sign-up process. Click on Save.
Shopify Cognito SSO - Select Attributes you want in Shopify

  • Now go to the Login pages tab and click on the Edit button as shown in the below image.
Shopify Cognito SSO - Click on Edit for SSO Configurations

  • Verify that the Callback URL is added to the URL field under the Allowed Callback URLs section and under the Identity Provider section, the Identity Provider selected is the Cognito user pool.
Shopify Cognito SSO - Select Authorization Code Grant

  • Select Authorization code grant under the OAuth 2.0 grant types. Under the OpenID Connect scopes section the scopes selected are Email, OpenID, and Profile. (Please refer to the images below) Click on the Save Changes button.
Shopify Cognito SSO - OAuth Grant Type and Scopes

  • Go to the Users tab under the User Management section, and click Create user.
Shopify Cognito SSO - Create New user

  • Enter details such as email address, phone number & password. Click on Create user to save the details.
Shopify Cognito SSO - provide email, password

  • Go to the Domain tab under the Branding section and copy the complete domain name {your domain name}.auth.{region name}.amazoncognito.com. This should be entered into the endpoints field under the Shopify Single Sign-On (SSO) application so keep them handy.
Shopify Cognito SSO - Copy Domain Name

You have completed the AWS Cognito side configuration to configure SSO into Shopify using AWS Cognito Credentials.

  • Navigate back to the miniOrange Single Sign On-SSO application.
Shopify Cognito SSO - Go to Shopify SSO App

  • Click on the Add Identity Provider button to add your IDP.
Shopify Cognito SSO - Add Identity Provider

  • Select OAuth 2.0 protocol.
Shopify Cognito SSO - Select OAuth 2.0 protocol

  • From the list of IDPs, select AWS Cognito.
Shopify Cognito SSO - Select Cognito IDP

  • Now, fill in the required details like Client ID, Client Secret, Endpoints, and Scope.
  • Please refer to the below table for configuring the values.
  • Note: You can find the cognito domain from Step 2.
IDP Display Name Choose the appropriate name
Authorize Endpoint https://{cognito-app-domain}/oauth2/authorize
Access Token Endpoint https://{cognito-app-domain}/oauth2/token
User Info Endpoint https://{cognito-app-domain}/oauth2/userInfo
Client ID from Step 2
Client secret from Step 2
Scope openid
Shopify Cognito SSO - Provide Client ID and Secret, Scopes and endpoints

  • Now you can click on Save.

You have completed the Shopify side configuration to set up SSO between AWS Cognito and Shopify.

  • After saving the IDP configuration, you will be redirected to the Test Connection step.
    Please perform Test Connection before mapping or fetching attributes, test connection ensures that your IDP configuration is correct.
  • Click on the Test Connection button.
Test Connection - Shopify AWS Cognito SSO

  • On entering valid AWS Cognito credentials you will see a pop-up window which is shown in the below screen.
Connection Succesfull - Shopify AWS Cognito SSO

  • Click on the Fetch Attributes button to fetch the IDP attribute.
Fetch Attributes - Shopify AWS Cognito SSO

  • Click on the + Attribute Mapping button to map attributes between Shopify and AWS Cognito.
Attribute Mapping - Shopify AWS Cognito SSO

  • Map the attributes by referring to the table below:
Attribute Name in Shopify Select the Shopify customer attribute key in which you want to sync incoming attribute value from IDP
Attribute Type IDP Attribute
Attribute Value Select the attribute key which you have fetched from your IDP and want to sync in Shopify
Map Attributes - Shopify AWS Cognito SSO

  • Click on Next.

Select Shopify Store Type:

SSO Configuration in Non-Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

  • Go to the application dashboard, enable the customer accounts extension as shown in the below image.
Shopify ADFS SSO Login - Enable Customer

  • Enable the New Customer Accounts extension and click on Save.
Shopify ADFS SSO Login - Enable /wp-content/uploads/2025/05/shopify-sso-paste-multipass-token.webps

  • Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.
Shopify ADFS SSO Login - Make app default

Testing Single Sign-On (SSO) for your Shopify store

  • Go to your Shopify Store.(https://<your-shopify-storedomain>)
  • Click on the User login icon.
SSO Login into Store - Shopify miniOrange SSO

  • You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.
  • Next, enter the six-digit OTP that will be sent to your registered email address. (This is a one-time process)
Shopify miniOrange SSO - 6 Digit OTP customer accounts

  • You’ll be successfully logged in to your Shopify store.
  • Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.
Shopify ADFS SSO Login - Make app default

  • Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.
Shopify ADFS SSO Login - Make app default

  • If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
  • Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.
Shopify ADFS SSO Login - Make app default

Testing Single Sign-On (SSO) for your Shopify store

  • Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
  • Click on the login button you customized earlier.
SSO Login into Store - Shopify miniOrange SSO

  • You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.
  • After login, if you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.
Shopify miniOrange SSO - Something went wrong error

SSO Configuration in Plus Shopify Stores

Choose the type of account you have enabled on your Shopify Store:

  • Go back to the SSO application, and navigate to Connect Store tab. Copy the Client ID, Client Secret, Post-Logout Redirect URL and Discovery Endpoint URL and keep them handy.
Shopify ADFS SSO Login - Copy Client ID and Secret

  • Click on the Customer Accounts link as shown in the below image.
Shopify ADFS SSO Login - Click on Customer Accounts

  • Select the Customer accounts option recommended by Shopify & look for the Identity Provider option, if not present please reach out to shopifysupport@xecurify.com.
Shopify ADFS SSO Login - Select Customer Accounts option

  • If the identity provider is present, click on Manage.
Shopify ADFS SSO Login - Click Manage

  • Click on Connect to Provider button.
Shopify ADFS SSO Login - Connect to identity provider

  • Add the Identity Provider name and fill in the details such as Discovery endpoint URL, Client ID, Client secret, Additional Scopes, Post-logout redirect URI parameter that you copied from above step. Click on Save.
Shopify ADFS SSO Login - Add identity provider name

Shopify ADFS SSO Login - Add metadata

  • Once the Identity Provider has been added, do the Test Connection.
Shopify ADFS SSO Login - Test Connections

  • After verifying the flow make the identity provider as Active.
Shopify ADFS SSO Login - Make identity provider active

  • Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.
Shopify ADFS SSO Login - Make app default

Testing Single Sign-On (SSO) for your Shopify store

  • Go to your Shopify Store.(https://<your-shopify-storedomain>)
  • Click on the User login icon.
SSO Login into Store - Shopify miniOrange SSO
  • You’ll be redirected to the login page of the identity provider (IDP) you configured in the previous step. Log in with your IDP account credentials.
  • You’ll be successfully logged in to your Shopify store.
  • Now, click on the Setup Guide button and follow the steps mentioned to get multipass token.
Shopify ADFS SSO Login - Get multipass token

  • Enable the Multipass Token option. Refer to this Faq to get the Multipass token value and paste it in the below field.
Shopify ADFS SSO Login - Enable multipass token

  • Click on Save.
  • Go to the application dashboard, you will see a warning box to add the login button extension on the Account page, click on the login widget extension link as shown in the below image to enable it.
Shopify ADFS SSO Login - Make app default

  • Navigate to the application home page and enable the IDP Login toggle option against the IDP you have configured.
Shopify ADFS SSO Login - Make app default

  • If you want to configure SSO into Shopify using multiple IDPs, then select your IDP from the list provided here, and setup SSO using that IDP.
  • Enable the IDP login toggle option for enabling SSO into Shopify using multiple IDPs.
Shopify ADFS SSO Login - Make app default

Testing Single Sign-On (SSO) for your Shopify store

  • Go to your Shopify Store login page.(https://<your-shopify-storedomain>/account/login)
  • Click on the login button you customized earlier.
SSO Login into Store - Shopify miniOrange SSO

  • You'll be redirected to the identity provider (IDP) login page. Now log in with your existing account credentials.
  • If you encounter an "invalid or missing reCAPTCHA token" error, accompanied by a "Something went wrong" message, refer to this FAQ to resolve the error.
Shopify miniOrange SSO - Something went wrong error

  • You’ll be successfully logged in to your Shopify store.

In this Guide, you have configured AWS Cognito Single Sign-On (SSO) by configuring AWS Cognito as an OAuth Provider and Shopify as an OAuth Client using our Shopify Single Sign-On - SSO Login App. This solution ensures that you are ready to roll out secure access to your Shopify Store using AWS Cognito login credentials within minutes.


Follow the steps outlined here to configure SSO in Shopify with your preferred IDP.

Redirection to any other site might be blocked in the browser. Please follow the steps given here to resolve the issue.

Follow the steps outlined here to redirect your customer to collections/cart or any other page.

You must upgrade to the SSO application’s Enterprise plan to enable the Auto-Redirect to the IDP feature. Follow the steps outlined here to enable this feature.

More FAQs ➔

Yes, you can use AWS Cognito as an Identity Provider (IdP) to enable Single Sign-On (SSO) for employee-only access to your Shopify store. This ensures that only users authenticated through your Cognito user pool (i.e., your employees) can log in.

How to configure AWS Cognito with the Shopify SSO app for employee-only login: In AWS Cognito:

Set up a Cognito user pool and add your employees as users manually or by federating with an external directory (e.g., SAML or Active Directory).

Create an App Client and configure the SAML settings, ensuring that user attributes such as email, name, or department are included in the SAML assertion.

You can also use groups, roles, or custom attributes to identify employee users within Cognito.

In the Shopify SSO app:

Import the metadata from your Cognito user pool to configure Shopify as the Service Provider (SP), and enable domain or group-based access control to allow login only for users matching defined employee criteria (e.g., @yourcompany.com).

This setup ensures that only authenticated employees from AWS Cognito can log in to your Shopify store, while blocking access from external or unauthorized users.

Yes, you can use the same AWS Cognito user pool to enable Single Sign-On (SSO) across multiple Shopify stores. This is ideal if you want a centralized identity system for managing user access across different storefronts—such as regional stores, partner portals, or franchise locations.

How to configure AWS Cognito SSO across multiple Shopify stores: In AWS Cognito:

Create a single Cognito user pool with all authorized users, configure a SAML-enabled App Client with callback URLs for each Shopify store, and include user attributes (e.g., email, roles) in the SAML assertion for access control.

In each Shopify store (via the SSO app):

Install the Shopify SSO app in each Shopify store, configure the same AWS Cognito SAML metadata as the Identity Provider, and optionally use user attributes to enable store-specific redirection or role-based access after login.

This setup enables seamless, centralized login for users across multiple Shopify storefronts while maintaining a consistent user experience and unified identity management through AWS Cognito.

Yes, you can configure Single Logout (SLO) with AWS Cognito on your Shopify store using the Shopify SSO app. This ensures that when a user logs out from the Shopify store, they are also logged out from AWS Cognito—providing a seamless and secure logout experience across sessions.

How to configure Single Logout with AWS Cognito and Shopify: In AWS Cognito:

Set up your Cognito user pool with a domain and enable a logout endpoint such as: https://.auth..amazoncognito.com/logout?client_id=YOUR_CLIENT_ID&logout_uri=YOUR_REDIRECT_URI

Ensure that the logout_uri matches one of the allowed redirect URIs in your App Client settings.

In the miniOrange Shopify SSO app:

Enable Single Logout (SLO) in the Shopify SSO app, set the Cognito logout URL as the IdP logout endpoint, and the app will handle both SP-initiated and IdP-initiated logouts to ensure users are signed out from both Shopify and Cognito.

Yes, you can use AWS Cognito for Single Sign-On (SSO) on a custom frontend (e.g., a React, Next.js, or Angular app) and still sync authenticated users with Shopify as customers. This setup allows you to fully control the login experience while ensuring Shopify recognizes users as valid customers.

On your custom frontend:

Integrate AWS Cognito authentication using the AWS Amplify SDK or Cognito-hosted UI. Once the user successfully logs in, retrieve their identity and attributes (like email, name, etc.) from Cognito.

To sync with Shopify:

The Shopify SSO app syncs users logged in via your custom Cognito frontend by creating or mapping them as Shopify customers. On Shopify Plus, it can use Multipass for direct login—ensuring users are automatically signed into Shopify after logging in through your site.

You can restrict AWS Cognito SSO login to only specific customer groups or tags in Shopify using the Shopify SSO app.

How to configure this: In AWS Cognito:

Add a custom attribute or group (e.g., shopifyAccess: true or userGroup: wholesale) to eligible users. Ensure this attribute is included in the SAML assertion sent to Shopify.

In the Shopify SSO app:

Set up access rules to allow login only if the user has specific attributes (e.g., certain roles, tags, or email domains). You can map Cognito user attributes to Shopify customer tags and restrict access based on them.

This ensures that only users matching the required conditions—like belonging to a “VIP” or “wholesale” group—can log in to the Shopify store via Cognito.


Please reach out to us at shopifysupport@xecurify.com, and our team will assist you with setting up the Shopify SSO application. Our team will help you to select the best suitable solution/plan as per your requirement.

ADFS_sso ×
Hello there!

Need Help? We are right here!

support