Glossary
/
customer-authentication
E-commerce customer authentication: verifying buyer identity (login, OTP, Shop). Differences with 3DS, Shopify 2026 accounts, and advice.
Updated on
June 4, 2026
Customer authentication is the process that verifies the identity of a buyer before giving them access to their customer account, order history, or sensitive actions (address changes, returns, subscriptions). In e-commerce, it is distinct from payment authentication (3D Secure): the former identifies the person on the store; the latter validates the bank transaction.
Summary
Definition: authentication, identification, and authorization
Authenticating a customer means confirming that they are indeed the person associated with the account or email entered, via a proof factor: password, one-time password (OTP), magic link, social login, or Shop recognition.
Three closely related concepts. Identification: the customer states who they are (email, customer number). Authentication: they prove their identity (received code, correct password). Authorization: the system matches what they are allowed to do once logged in (view orders, edit profile).
Useful distinctions in e-commerce. Customer authentication vs. guest checkout: under guest checkout, the customer purchases without a persistent account; an email can suffice for order confirmation, without a long-term authenticated session. Account authentication vs. payment authentication: 3DS or bank verification does not replace logging into the customer account. Login vs. sign up: account creation registers the profile; authentication occurs with each new session.
Why client authentication is important
Well-thought-out authentication balances security, trust, and friction at checkout. Data protection: orders, addresses, saved payment methods, loyalty programs. Personalized experience: recommendations, history, quick repurchases for recurring customers. Self-service: package tracking, returns, invoices without contacting customer service. Marketing: qualified email and SMS database in the customer database (with consent). Fraud prevention: account access is harder to usurp than a simple, unprotected email link.
Too much friction (complex password, double entry) increases cart abandonment. Too little security exposes you to account takeovers. The challenge is to secure without blocking conversion.
Client authentication on Shopify
Shopify offers two generations of customer accounts. New customer accounts (recommended): passwordless authentication via email code, Shop login, Google/Facebook options, self-service returns, app extensions (Shopify Changelog, Feb. 2026). Classic accounts (email + password, Liquid templates customers/login.liquid): deprecated since February 2026; sunset announced for later in 2026. Migration is advised.
Activation: Shopify admin > Settings > Customer accounts. Existing customer data (orders, addresses) are preserved during migration; only the login method changes.
For headless storefronts: Shopify points towards the Customer Account API (OAuth 2.0) rather than the old Storefront API mutations. Apps customize the account space via Customer Account UI extensions.
Third-party apps (B2B
In summary
The essential points to remember are the following. Client authentication = proving identity to access the account and sensitive actions. Distinct from payment authentication (3DS) and compatible with guest checkout. Shopify 2026: new passwordless accounts; legacy deprecated. Objective: security + frictionless self-service. Migrate, communicate, test apps, and mobile journeys.
Associated terms, FAQ, and resources
Associated terms
Customer account: space accessible after authentication.
Checkout: purchasing journey, guest or logged in.
3D Secure: banking authentication during payment.
Customer experience: perceived quality of the login and account experience.
FAQ
Should customer account creation be mandatory to purchase?
No, in B2C it is recommended to keep the guest checkout and invite users to create an account after purchase. Mandating it often increases cart abandonment.
Do new Shopify accounts still have a password?
By default, no: login via email code (OTP) and Shop / social options. Apps can reintroduce email + password on the new accounts framework if needed.
Customer authentication and GDPR: what to plan for?
Clear privacy policy, separate marketing consent, ability to exercise rights of access/deletion, login logs limited to what is necessary.
What happens to legacy accounts in 2026?
Shopify has deprecated legacy accounts in February 2026. An end-of-service date will be announced; migrate to the new customer accounts to keep returns, extensions, and support.
Going further
Sources: Shopify Changelog (legacy customer accounts deprecated), Shopify Help Center (Customer accounts).
In brief
Customer authentication = proving identity to access the account and sensitive actions.
Distinct from payment authentication (3DS) and compatible with guest checkout.
Shopify 2026: new passwordless accounts; legacy deprecated.
Goal: security + self-service without excessive friction.
Migrate, communicate, test apps and mobile journeys.
Associated terms, FAQ, and going further
Associated Terms
Customer Account: area accessible after authentication.
Checkout: purchasing journey, guest or logged-in.
3D Secure: banking authentication during payment.
Customer Experience: perceived quality of the login and account journey.
FAQ
Should account creation be mandatory to purchase?
No, in B2C it is recommended to keep the guest checkout and offer account creation after purchase. Mandatory creation often increases cart abandonment.
Do new Shopify accounts still have a password?
By default, no: login is via email code (OTP) and Shop / social options. Apps can reintroduce email + password on the new accounts framework if needed.
Customer authentication and GDPR: what to plan for?
Clear privacy policy, separate marketing consent, ability to exercise access/deletion rights, connection logs limited to the minimum necessary.
What happens to legacy accounts in 2026?
Shopify deprecated legacy customer accounts in February 2026. An end-of-service date will be announced; migrate to new customer accounts to keep returns, extensions, and support.
Go Further
Sources: Shopify Changelog (legacy customer accounts deprecated), Shopify Help Center (Customer accounts).
Enzo
June 4, 2026
