Search for a Shopify customer account login app and most results say the same thing: customer accounts only let people sign in with a six-digit emailed code, so you need an app for anything else.

That framing is out of date. Google and Facebook social sign-in is a standard setting in your Shopify admin, at no extra cost, with no plan requirement stated. Connecting your own OpenID Connect identity provider — Okta, Auth0, Microsoft Entra ID, Amazon Cognito — is also native, if you are on Shopify Plus.

What you genuinely cannot get is a short list: password login, providers other than Google and Facebook, and single sign-on below Plus. Everything else in the "you need a login app" pitch is either already free or not solvable by an app at all.

Below: the real native boundary, two corrections that trip up a lot of merchants, the one thing no App Store app can do, and six apps with USD pricing. Researched September 2, 2026.

The short version

Google and Facebook sign-in are free and native. Settings > Customer accounts > Authentication > Manage. Multiple providers can be active at once, alongside the emailed code rather than replacing it.

Only three things are genuinely missing. Password login, providers beyond Google and Facebook (Apple, X, Amazon, LinkedIn, Google One Tap, phone SMS), and corporate SSO below Plus.

Multipass is not the answer to anything on customer accounts. It needs Shopify Plus and legacy customer accounts, and legacy is deprecated.

Shopify B2B is available on all plans. The "B2B requires Plus" claim in older articles is wrong. What is Plus-only is the identity provider connection.

No app can replace the sign-in page, and at least one prominent App Store social login app supports legacy customer accounts only. Check the account version before anything else.

What Shopify gives you natively

The default is unchanged: the customer enters an email address, receives a one-time six-digit code, and signs in. No password. An unknown email creates the customer profile automatically, so there is no separate registration step, and sessions persist up to 365 days. What changed is what you can layer on top.

Sign-in option	Plan requirement	Effect on the default
Email one-time six-digit code	All plans (default)	—
Sign in with Shop	Automatic with Shop Pay; also on Shopify, Advanced, Retail plans	Additive
Social sign-in with Google	No plan requirement stated	Additive
Social sign-in with Facebook	No plan requirement stated	Additive
Your own OIDC identity provider	Shopify Plus only	Replaces the default entirely
Email and password	Not available (legacy only, and legacy is deprecated)	—
Multipass	Not supported on customer accounts	—

Two details do most of the work here.

Social sign-in is additive and free. Shopify describes it as working alongside the passwordless default, with multiple providers active at once. The only customer data that syncs to Shopify is the email address — worth knowing if you hoped to capture names or phone numbers this way.

The identity provider connection is not additive. Shopify's phrasing is "Replace the default sign-in experience." Turn on Okta and the emailed code and social buttons stop being used. Merchants expecting Okta as one more button next to Google are surprised by this.

One caveat on Apple. Shopify's sign-in options overview lists Apple alongside Google, Facebook, and Shop credentials, but only Google and Facebook have connection procedures. The documentation does not make clear whether that Apple mention refers to the Sign in with Shop passkey experience or something undocumented. If Apple sign-in is a hard requirement, treat it as an app requirement.

On Plus, check the requirements before assuming your IdP qualifies: OAuth 2.0 authorization code flow, PKCE, RP-Initiated Logout rather than back-channel or front-channel, endpoints that respond within one second, email_verified set to true, and no HS256 signing. Sessions can run 90 days, but without a refresh token from your IdP they end at access token expiry — typically an hour.

Multipass: the correction most articles still get wrong

Shopify's developer documentation carries a Legacy banner at the top of the Multipass page: "Multipass login is only available with legacy Customer accounts." Its requirements section adds that your store must be on Shopify Plus. The Help Center's upgrade guide states it a second time: "Multipass isn't supported on customer accounts. If you need to use your own identity provider, then you can connect it to customer accounts."

So Multipass needs both Plus and an account version Shopify has deprecated. Shopify's own comparison table also notes that Multipass does not support SSO — which undercuts the reason most people reach for it. Tokens are valid 15 minutes and single-use, and it cannot provide SSO across multiple Shopify stores without an external redirect. The supported replacement is a connected OIDC identity provider, which is Plus-only. The migration itself is covered separately in our guide to the legacy customer accounts deprecation.

B2B is on all plans, and B2B buyers still get the six-digit code

B2B on Shopify is not Plus-only. The Help Center's B2B feature overview lists it as available on all plans, with differences in things like catalog counts. It does require customer accounts — legacy customer accounts cannot be used for B2B customers and orders at all. And B2B buyers sign in like everyone else: the email associated with a company location, plus a one-time PIN sent to it. So a B2B merchant whose buyers' IT department mandates Okta is in the same position as a DTC merchant. Native SSO means Plus.

One more behavior to plan for: the "restrict access to B2B customers only" setting blocks browsing but does not redirect every visitor to a sign-in page. A genuine login wall needs a third-party app or custom Liquid — Shopify's help names Locksmith as an example.

The thing no app can do

Apps cannot replace or rebuild the Shopify sign-in page. Customer account UI extensions have targets for the order index, order status, profile, and full pages, but none for the sign-in page. The Help Center is explicit: "You can't add customization blocks to the sign-in page. You can customize the logo, colors, fonts, and a brand image for the sign-in page in the checkout and accounts editor." The B2B help page repeats it: "Customizations that you make to customer accounts with apps, apply only to signed-in customer accounts pages, but not to the sign-in page."

That leaves login apps exactly two architectures. On Plus, an app can register itself in the native OIDC identity provider slot — the documented, supported path. On non-Plus stores, apps inject buttons, popups, or drawers into your theme, authenticate externally, then establish a Shopify session. Shopify does not document that second path, and theme compatibility problems and redirect errors are recurring themes in the negative reviews of the apps below.

The first question to ask about any login app

Before pricing, before features: does this app support the current customer accounts, or only legacy?

This is not theoretical. HIKO Social Login — 4.5 stars across 45 reviews and twenty-plus providers — states in the fifth bullet of its own feature list: "Only legacy customer accounts are supported." Its "Works with" section names "Legacy customer account," and its $4.99/month Premium tier includes Multipass, which is itself legacy-only.

Source: Shopify App Store listing, captured September 3, 2026.

If your store is on customer accounts, that app cannot help you, whatever its rating. A working checklist, in order:

1. Does the listing name customer accounts, or only legacy? Read the "Works with" section, not the marketing copy.
2. On your plan, does it use the native identity provider slot or inject UI into your theme? Plus-only Custom IdP features do not apply if you are not on Plus.
3. Is the thing you want free natively? Google and Facebook are.
4. What is the total cost including SMS or IdP fees the app does not charge you for?
5. Are you buying authentication, or access control? Different products.

Six apps, and what each is actually for

Pricing verified on the Shopify App Store on September 2, 2026. All charges are billed in USD.

miniOrange Single Sign On-SSO — corporate SSO without Plus

miniOrange Single Sign On‑SSO answers one question: what do you do when you need Okta or Microsoft Entra ID SSO and you are not on Plus? Shopify has no native path there.

Source: Shopify App Store listing, captured September 3, 2026.

The listing describes SSO for Plus and non-Plus stores using SAML, OAuth, OIDC, or JWT, with Entra ID, Okta, Cognito, Keycloak, Auth0, Salesforce, or a custom IdP, for both legacy and current customer accounts. Note the SAML support: Shopify's native requirements are OIDC-only, so SAML reaches Shopify only through an app that bridges it.

No free plan; 15-day free trial on every tier. Non-Plus Starter is $99/month for 1,000 unique users per month and a single IdP; non-Plus Scale $149/month for 3,000 users and multiple IdPs. Plus Starter is $149/month, Plus Scale $249/month. Higher user tiers are not listed on the App Store.

Rated 5.0 across 56 reviews, all five stars — which also means there are no critical reviews to learn failure modes from. What reviews praise is setup support, including two US stores in spring 2026: read it as an enterprise product where hands-on configuration is part of the deal. It has no Built for Shopify badge, and pricing metered by unique users per month is the wrong shape for a high-traffic DTC store. How it replaces the default sign-in on a non-Plus store is a vendor claim with no Shopify documentation behind it.

Oxi: Social Login & Wishlist — the providers Shopify does not offer

Oxi: Social Login & Wishlist covers what native social sign-in does not: Apple, X, Amazon, LinkedIn, Google One Tap, and email OTP, alongside Google, Facebook, and Login with Shop.

Source: Shopify App Store listing, captured September 3, 2026.

Essential is $2.99/month (all social login except Apple and One Tap), Pro $5.99/month (adds Google One Tap, Sign in with Apple, Shop Login, cart sync), Plus $14.99/month. No free plan, 7-day free trial. It holds the Built for Shopify badge and has been listed since June 2016.

The Plus tier name is literal: "For Plus stores on New Customer Accounts, OxiApps works as a Custom Identity Provider for seamless native login." For a Plus store wanting a managed identity provider without standing up Auth0 or Okta, $14.99/month is a cheap way to get one. On a non-Plus store that feature does not apply, and you get the theme-injected approach.

Rated 4.9 across 106 reviews, including 5 one-star reviews. The most repeated complaint among them is a redirect error on non-Facebook providers — a US store in 2021, a Hong Kong store after nine months of paid use in 2024. One developer reply applies to this whole category: responding to a complaint about slow-loading login buttons, Oxi Apps explained that "all the 3rd party apps and scripts are loaded by Shopify's asynchronous engine and given a timeslot."

OTP+ B2B SMS & Social Login — free, and phone-first

OTP+ B2B SMS & Social Login does something Shopify has no native equivalent for: phone number OTP login over SMS, plus one-tap Google and Apple.

Source: Shopify App Store listing, captured September 3, 2026.

The listing shows a single price: Free. It holds the Built for Shopify badge, its "Works with" section names the Customer accounts extension, and the developer, siimple.ai, is based in San Jose, California. It can also require phone OTP verification at cart and checkout, aimed at fake orders and chargebacks.

Two things to check first. SMS delivery appears to run through Google Firebase, and the listing does not state who pays for it — budget separately and confirm with the developer. And the track record is short: launched October 2024, 28 reviews, with reviewers in Pakistan, India, and Indonesia. The "Based in United States" badge refers to the developer's location, not its customer base.

Ex OTP Login with Phone Number — OTP behavior you can configure

Ex OTP Login with Phone Number from Extendons overlaps with OTP+ but earns its place on one point: it lets you control OTP expiry time and resend behavior, which Shopify's native code does not.

Source: Shopify App Store listing, captured September 3, 2026.

The free plan sends and verifies 5 OTPs total — a trial in practice. Core is $4.99/month for phone and email OTP; Spark $7.99/month adds popup login templates and post-login redirect; Boost $12.99/month adds WhatsApp and Telegram delivery plus Google, Facebook, LinkedIn, and X login. Annual billing saves 16 to 18 percent, with a 10-day free trial on paid plans. SMS and WhatsApp go through providers you connect yourself, so delivery costs are yours on top.

Rated 5.0 across 41 reviews. One caution: unlike miniOrange and OTP+, this listing's "Works with" section does not name the Customer accounts extension. Compatibility with current customer accounts appears only in the listing body — "Fully compatible with new and legacy customers" — as a vendor claim. Verify on a development store first.

BSS B2B Lock, Login & Password — not a login method at all

BSS B2B Lock, Login & Password is here to draw a line, because it is one of the first results merchants meet when searching for a B2B login app. It does not add a way to sign in. It controls what visitors can see: hiding products, pages, and prices, locking access by URL or customer tag, gating with passcodes. That is access control, not authentication — worth stating explicitly, because conflating the two sends merchants to the wrong category.

Source: Shopify App Store listing, captured September 3, 2026.

Rated 4.9 across 605 reviews, with the Built for Shopify badge. Free plan available, then $9.99, $24.99, and $49.99/month, with 20 percent off annual and a 7-day free trial.

One review describes this article's subject precisely. A Canadian B2B merchant (Rosdan Footwear Inc., August 11, 2026) wrote: "Ever since Shopify changed their login to 2AF only, this caused issue to our flow." The "2AF" is presumably a slip for 2FA, and the emailed code is not two-factor authentication at all — it is single-factor and passwordless. But the operational problem is real: a screened-access B2B flow broke when the sign-in method changed.

Comparison

	Shopify native	miniOrange	Oxi	OTP+	Ex OTP	HIKO	BSS
Primary use	Baseline sign-in	Enterprise SSO	Consumer social	Phone OTP + social	Phone/WhatsApp OTP	Social (legacy only)	Access gating
Price range	$0	$99–$249/mo	$2.99–$14.99/mo	$0	$0–$12.99/mo	$0–$4.99/mo	$0–$49.99/mo
Built for Shopify	—	No	Yes	Yes	Yes	No	Yes
Current customer accounts	Yes	Yes	Yes	Yes	Vendor claim only	No — legacy only	Yes
Adds SAML / OIDC SSO	OIDC, Plus only	SAML/OAuth/OIDC/JWT	Custom IdP, Plus tier	No	No	No	No
Adds Apple sign-in	Not configurable	Not stated	Pro tier	Yes	No	Premium tier	No
Adds phone SMS OTP	No	Listed for Plus	No	Yes	Yes	No	No
Rating / reviews	—	5.0 / 56	4.9 / 106	4.9 / 28	5.0 / 41	4.5 / 45	4.9 / 605

Which path fits your store

Google or Facebook, nothing more. Turn it on natively. No app, no cost. This covers more merchants than the app marketing suggests.

DTC wanting Apple sign-in or Google One Tap. Native does not do it. Oxi covers both from its Pro tier at $5.99/month; OTP+ adds Apple and Google one-tap at no cost, though it is built around phone OTP. Expect the added login buttons to render slightly after the rest of the page.

On Plus, needing Okta, Auth0, or Entra ID. Use the native identity provider connection — no app required. Check the requirements first, and remember it replaces the default sign-in rather than adding to it. B2B on Plus is the same path: your buyers stop receiving the six-digit code entirely.

B2B, not on Plus, with a corporate IdP requirement. The case with no native answer. miniOrange from $99/month is the App Store option; the alternative is upgrading to Plus. Price both.

Phone number as primary identifier, or OTP verification at checkout. OTP+ (free, US-based developer) or Ex OTP ($4.99 to $12.99/month, more control over OTP behavior). Budget the SMS provider separately.

You want password login back. Not available, and not returning. What the stakeholder usually wants is fewer steps at sign-in, which social sign-in or Sign in with Shop solves better.

You want to redesign the sign-in page. Nothing does this — logo, colors, fonts, and a brand image only, edited in the checkout and accounts editor.

You want to hide prices until sign-in. That is access control. BSS or Locksmith. It does not change how anyone signs in.

Three things to know before you change anything

Changing your customer accounts subdomain breaks social sign-in. Add the new redirect URIs at Google and Facebook before the change, or nobody can sign in. Shopify flags this with a Caution, and it applies to a connected identity provider too.

Deleting a customer profile does not deactivate the account. Signing in with the same email recreates it, and individual accounts cannot be deactivated.

Shopify does not publish sign-in attempt or OTP resend limits. If your risk assessment needs those numbers, they are not public.

Bottom line

Before evaluating a single app, turn on Google and Facebook and see whether the complaints stop. That path is free and supported, and it removes the problem for a lot of stores.

If it does not, your plan determines the rest. On Plus, the native identity provider connection covers enterprise SSO without an app. Below Plus, an app is the only route and you are paying for an undocumented integration — worth pricing against the Plus upgrade rather than assuming the app wins. And whatever you install, check the account version first.

Sources

All verified September 2, 2026.

• Shopify Help Center — Customer accounts, Sign-in options, Social sign-in, Identity provider requirements, Upgrading to customer accounts
• Shopify Help Center — Sign-in and customer accounts in B2B, Overview of B2B features
• shopify.dev — Multipass, Customer account UI extensions
• Shopify App Store listings for the six apps above