Playbook · Shopify Plus Multipass SSO login failing

Shopify Plus Multipass SSO login failing — token, secret, redirect, customer account.

Written for a Shopify Plus owner or ops lead whose Multipass single sign-on fails so buyers never land in a logged-in customer account after your IdP or custom app issues a Multipass token. DIY-first: prove Multipass secret match, token payload (email / created_at / return_to), redirect host, and customer account create-or-login hop; stop treating classic vs new customer accounts login, customer account UI extensions, Hydrogen cart, or Storefront API throttle as the same bug. Distinct from customer accounts login broken, customer account UI extension missing, Hydrogen cart broken, and Storefront API throttle. No earnings claims, no invented case studies.

Nico at Latch AI Ops · Sep 10, 2026 · ~11 minute read

Buy the 72-hour install — $997 Customer accounts login Account UI extension Merchant FAQ

Multipass SSO failing — not classic/new accounts login, UI extension, Hydrogen cart, or Storefront throttle.

Several login and headless products can look like “customer cannot get in.” They do not share a fix. This page is only when Shopify Plus Multipass SSO fails — invalid token, wrong secret, return_to / redirect mismatch, or customer account create/login hop after /multipass/<token>. Classic vs new customer accounts, theme login form, or Shop login without Multipass is customer accounts login broken. New customer accounts profile / order-history app blocks missing is customer account UI extension missing. Headless cart empty after add is Hydrogen cart broken. Storefront API 429 / cost limit killing headless calls is Storefront API throttle.

Multipass login failing is a Plus Multipass secret + encrypted token + return_to redirect + customer account session problem — not theme customers/login.liquid, not account UI extensions, not Hydrogen cart cookies, and not Storefront API cost budgets.

Prove Multipass secret vs token vs return_to redirect vs customer account state.

Confirm Plus and Multipass. In Settings → Customer accounts, Multipass must be enabled and the secret shown (or last rotated) must match what your IdP / custom app encrypts with. Capture: shop primary domain + any Markets domains, Multipass enabled yes/no, secret fingerprint (last 4 only), issuer app name, failing /multipass/ URL host, and whether return_to is present.

Decode a failing token offline (AES + HMAC Multipass format — use your own tooling; never paste live secrets into public forums). Check email, created_at freshness (clock skew / expired tokens are a common reject), return_to absolute URL on an allowed shop host, and optional remote_ip. Compare to a working token from a known-good environment if you have one.

Split the surfaces. Theme /account/login or new customer accounts redirect loop without Multipass → customer accounts login broken. Account UI blocks missing after login → customer account UI extension missing. Hydrogen cart empty → Hydrogen cart broken. API 429 on Storefront → Storefront API throttle. /multipass/<token> reject, blank, or bounce → this page.

Fix secret mismatch, token clock skew, return_to domain, and account create/login hop.

Resync the Multipass secret. If you rotated in Shopify Admin and forgot the issuer (or the reverse), every token decrypt fails. Put the same secret in Shopify and the IdP / custom app config. Redeploy the issuer so staging secrets cannot hit production.

Issue a fresh token with a current created_at (UTC). Stale tokens and large clock skew between issuer servers and Shopify are rejected. Set return_to to a path on the shop domain the buyer actually uses (primary custom domain or the Markets domain for that locale) — www vs apex and wrong country domain are common redirects into nowhere.

Confirm the customer account hop. Multipass can create or log in a customer by email; disabled customers, email conflicts, and new customer accounts identity provider hops can still fail after a valid decrypt. Test with a known new email and a known existing customer. Retest: IdP login → Multipass redirect → logged-in account home (or intended return_to) with a session cookie — not an error page and not a loop back to the IdP.

Checklist and how to prove Multipass SSO lands in a customer session.

Shop is Shopify Plus with Multipass enabled in Customer accounts settings.
Multipass secret in Admin matches the issuer (IdP / custom app) byte-for-byte after any rotation.
Token includes valid email, fresh created_at, and return_to on an allowed shop host/path.
Issuer environment (prod vs staging) points at the live shop, not a stale myshopify domain you no longer use for Multipass.
Customer can be created or logged in (not disabled; email not blocked by identity hop conflicts).
Retest: private window → IdP → /multipass/token → account session on return_to.

Proof is a private-window recording of Multipass landing in a logged-in customer session (and a redacted note that secret + created_at + return_to matched) — not a theme login form screenshot, not an account UI extension screenshot, not a Hydrogen cart HAR, and not a Storefront API 429 log alone.

You tested classic/new accounts login, account UI extension, Hydrogen cart, or Storefront throttle instead.

Common misfires: customer accounts login broken (classic vs new / theme form / Shop login without Multipass), customer account UI extension missing, new customer accounts login broken, Hydrogen cart broken, and Storefront API throttle. Fix Multipass token / secret / redirect here when the SSO hop itself fails.

When to stay DIY vs pay $997.

Stay DIY when the Multipass failure is a one-time secret sync, fresh token, return_to domain, or customer create/login fix you can clear from this checklist. Pay when the work is connecting the stack you already have so lead capture is not dying in DMs, Multipass / SSO login exceptions land in a channel you already check, and the live store is one workflow instead of a spreadsheet plus a Slack bot you forgot. That is the Latch AI Ops install.

What $997 USD one-time buys: lead capture on the live store, ops alerts in a channel you already check, and a checkout-ready workflow. 72 hours after collaborator access, not after payment. One live Shopify store. Access plus a delivery thread. Store URL collected at checkout. Not a SaaS seat, not an upsell retainer, not a conversion guarantee, not a brand or theme job.

Other shops’ public ranges, not testimonials: a checkout / ops install typically runs $500–$2,500. A full ops consulting block typically runs $2,000–$5,000. $997 is the cheap end of that work, sold as a 72-hour install of three systems — not as an earnings number or SSO-conversion claim.

What it does not buy: recovered logins as a guaranteed rate, a Multipass SaaS, an identity-provider rebuild, or a case study. Latch AI Ops has not published customer proof because there are no customers yet. You are buying the install.

Checkout is on Whop. Operator is Nico. United States offer. You can revoke collaborator access after handoff. We do not take owner passwords.

Open Whop checkout — $997 Customer accounts login Account UI extension Merchant FAQ