Multipass link

Retired Boards Appdev Authentication

Topic summary

A developer successfully generates Multipass tokens and customer access tokens using the customerAccessTokenCreateWithMultipass GraphQL mutation. Queries with the returned access token work correctly, and customers appear in Shopify’s customer list.

The core issue: Redirecting users to the Multipass URL fails:

  • Using the store number ID (https://shopify.com/{store number id}) returns a blank screen
  • Using the store UUID (https://myshopify.com/{store uuid}) returns a “422 Invalid multipass request” error

Attempted solutions:

  • Tested both store ID formats as the {shopifyStore} value
  • Running locally with Hydrogen (redirect_uri should be http://localhost:3000/account/authorize)

Open questions:

  • Is the password-protected store status causing the redirect failure?
  • What is the correct approach for redirecting from GraphQL’s customerAccessToken to the Multipass URL?
  • How should the store identifier be formatted in the redirect URL?
Summarized with AI on November 5. AI used: claude-sonnet-4-5-20250929.
1

I have setup a store to use the Multipass. The token and customerAccess token are getting generated and appear to be valid. When I use the customerAccessTokenCreateWithMultipass graphql mutation https://shopify.dev/docs/api/storefront/2024-07/mutations/customerAccessTokenCreateWithMultipass and then run a query to search for the customer using the returned access token everything appears to be working. I can also see the created customers in the Shopify Customer list.

Where it breaks down is when I redirect the browser to (using these directions https://shopify.dev/docs/api/multipass#step-6-redirect-your-customer-to-your-shopify-store)

https://{shopifyStore}/account/login/multipass/{customerAccessToken} I hit a page getting an error.

I’m running this locally using Hydrogen but the redirect_uri should be 'http://localhost:3000/account/authorize. What am I doing wrong? Is this because the store is currently password protected? I have tried both https://shopify.com/{store number id} and https://{store uuid}.myshopify.com as the {shopifyStore} value . Using the {store number id} gives a blank screen. Using the {store uuid} link gives me a 422 Invalid multipass request.

If I have received the customerAccessToken from the graphql, do I need to redirect the user to the multipass url?