---
title: Authentication
description: Enable Shopify customer sign-in, order history, profile details, and saved addresses.
url: "https://shop-docs.labs.vercel.dev/docs/anatomy/authentication"
docs_index: /llms.txt
lastUpdated: 2026-09-13
type: guide
---

> For an index of all documentation, see [/llms.txt](/llms.txt).

The template includes opt-in customer authentication through Shopify Customer Accounts. Signed-in customers can manage their profile and addresses, review orders, and continue to checkout with their customer identity.

Authentication is disabled by default. The storefront remains guest-only until you complete the setup below.

## Configure customer accounts

Set `auth.isEnabled` to `true` in `lib/config/index.ts` and configure these environment variables:

```bash
CUSTOMER_ACCOUNT_SESSION_SECRET="your-session-secret-here"
SHOPIFY_CUSTOMER_ACCOUNT_API_CLIENT_ID="shp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
SHOPIFY_CUSTOMER_ACCOUNT_API_CLIENT_SECRET="your-customer-account-client-secret-here"
```

Shopify provides the confidential client ID and client secret. Generate the session secret yourself:

```bash
openssl rand -base64 32
```

Keep both secrets server-only and identical across every instance of a deployment. Rotating the session secret signs out all customers. A build with authentication enabled fails when the session secret, client ID, or client secret is missing.

Customer Account OAuth requires a public HTTPS origin. For local testing, open the storefront through a public HTTPS tunnel.

In Shopify Admin:

1. Go to **Settings → Customer accounts → Edit**.
2. Choose **Customer accounts**, then save.
3. Install the **Headless** sales channel.
4. Go to **Sales channels → Headless → your storefront → Customer Account API**.
5. Copy the confidential client ID and client secret.
6. Add `https://YOUR_DOMAIN/account/authorize` as the callback URI.
7. Add `https://YOUR_DOMAIN/` as the logout URI.
8. Set `SHOPIFY_CUSTOMER_ACCOUNT_API_CLIENT_ID` and `SHOPIFY_CUSTOMER_ACCOUNT_API_CLIENT_SECRET` to the copied values.
9. Confirm `NEXT_PUBLIC_SHOPIFY_STORE_DOMAIN` identifies the same store.

Shopify does not support wildcard callback or logout URIs. Register every production, preview, and tunnel origin that needs authentication. See [Environment Variables](/docs/reference/env-vars) for the full variable reference.

## Customer experience

Customers sign in at `/account/login` and sign out through `/account/logout`. The storefront provides:

- `/account/profile` for name and email details
- `/account/orders` and `/account/orders/[id]` for order history and details
- `/account/addresses` for creating, editing, deleting, and choosing a default address

Sessions use encrypted, HttpOnly cookies rather than browser-readable storage. Expired access tokens refresh through `/account/refresh`. Logout ends both the storefront session and the Shopify sign-in session.

When authentication is enabled, the cart follows the customer session. Signing in attaches the browser cart when possible, and checkout can carry the customer's saved details. Cart synchronization is best-effort; an authentication redirect still completes if cart synchronization fails.

Customer Account API data is personalized and is not publicly cached.

> **Security requirements:** Never expose access, refresh, or ID tokens to browser-readable storage. Keep logout as a same-origin `POST`.

If sign-in redirects fail, compare the deployed origin, callback URI, logout URI, store domain, client ID, and client secret character for character. Failed callbacks return to the storefront instead of restarting sign-in.

## What’s next

You can change the account navigation, add a dashboard, or expose more Customer Account API data such as store credit or subscriptions. Validate additions against the Customer Account API schema, which differs from the Storefront API, and keep private customer data behind authentication.

See [Proxy](/docs/anatomy/proxy) for the storefront's request-routing role in customer account URLs.

---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)