{
  "info": {
    "_postman_id": "326b5157-ead9-441d-89cd-94cdb99b7892",
    "name": "Shopify Multipass API",
    "description": "Multipass login enables seamless single sign-on for Shopify Plus stores. It allows store owners who have a separate website and a Shopify store to redirect users from the external website and automatically log them into the Shopify store. Multipass tokens are generated server-side using AES encryption and HMAC signing with the store multipass secret, then passed to the Shopify login endpoint via URL. Tokens are valid for 15 minutes and can only be used once. Requires a Shopify Plus plan.\n\nContact Support:\n Name: Shopify\n Email: api@shopify.com",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
    "createdAt": "2026-06-05T13:18:44.000Z",
    "updatedAt": "2026-06-05T13:18:44.000Z",
    "lastUpdatedBy": "35240",
    "uid": "35240-326b5157-ead9-441d-89cd-94cdb99b7892"
  },
  "item": [
    {
      "name": "account",
      "item": [
        {
          "name": "login",
          "item": [
            {
              "name": "multipass",
              "item": [
                {
                  "name": "{token}",
                  "item": [
                    {
                      "name": "Shopify Log in a customer using a Multipass token",
                      "id": "dae09267-8761-40f5-905b-12e8886ed988",
                      "protocolProfileBehavior": {
                        "disableBodyPruning": true
                      },
                      "request": {
                        "method": "GET",
                        "header": [],
                        "url": {
                          "raw": "{{baseUrl}}/account/login/multipass/:token",
                          "host": [
                            "{{baseUrl}}"
                          ],
                          "path": [
                            "account",
                            "login",
                            "multipass",
                            ":token"
                          ],
                          "variable": [
                            {
                              "id": "6092eb5e-1322-4cdc-914b-74efd1f46dc7",
                              "key": "token",
                              "value": "<string>",
                              "description": "(Required) The encrypted and signed Multipass token. Generated by encrypting a JSON payload containing at minimum an email address, then Base64 URL-encoding the result."
                            }
                          ]
                        },
                        "description": "Authenticates a customer using a Multipass token. The token is generated server-side by encrypting a JSON customer payload with AES-128-CBC and signing it with HMAC-SHA256 using keys derived from the store Multipass secret. The token is valid for 15 minutes and can only be used once. On success the customer is logged in and redirected to the return_to URL or the store homepage."
                      },
                      "response": [
                        {
                          "id": "a66bcd5d-3e09-46b8-bf4b-37b5cd20251f",
                          "name": "Successful authentication. Redirects to the return_to URL specified in the token payload or the store homepage.",
                          "originalRequest": {
                            "method": "GET",
                            "header": [],
                            "url": {
                              "raw": "{{baseUrl}}/account/login/multipass/:token",
                              "host": [
                                "{{baseUrl}}"
                              ],
                              "path": [
                                "account",
                                "login",
                                "multipass",
                                ":token"
                              ],
                              "variable": [
                                {
                                  "key": "token"
                                }
                              ]
                            }
                          },
                          "status": "Found",
                          "code": 302,
                          "_postman_previewlanguage": "text",
                          "header": [
                            {
                              "disabled": false,
                              "description": {
                                "content": "The redirect destination URL",
                                "type": "text/plain"
                              },
                              "key": "Location",
                              "value": "<uri>"
                            },
                            {
                              "disabled": false,
                              "description": {
                                "content": "Session cookie for the authenticated customer",
                                "type": "text/plain"
                              },
                              "key": "Set-Cookie",
                              "value": "<string>"
                            }
                          ],
                          "cookie": [],
                          "responseTime": null,
                          "body": null,
                          "createdAt": "2026-06-05T13:18:45.000Z",
                          "updatedAt": "2026-06-05T13:18:45.000Z",
                          "uid": "35240-a66bcd5d-3e09-46b8-bf4b-37b5cd20251f"
                        },
                        {
                          "id": "b0ec2803-1a9b-4817-a97e-5bff2f78b319",
                          "name": "Token is invalid, expired, or has already been used.",
                          "originalRequest": {
                            "method": "GET",
                            "header": [],
                            "url": {
                              "raw": "{{baseUrl}}/account/login/multipass/:token",
                              "host": [
                                "{{baseUrl}}"
                              ],
                              "path": [
                                "account",
                                "login",
                                "multipass",
                                ":token"
                              ],
                              "variable": [
                                {
                                  "key": "token"
                                }
                              ]
                            }
                          },
                          "status": "Unauthorized",
                          "code": 401,
                          "_postman_previewlanguage": "text",
                          "header": [],
                          "cookie": [],
                          "responseTime": null,
                          "body": null,
                          "createdAt": "2026-06-05T13:18:45.000Z",
                          "updatedAt": "2026-06-05T13:18:45.000Z",
                          "uid": "35240-b0ec2803-1a9b-4817-a97e-5bff2f78b319"
                        },
                        {
                          "id": "14e9a15b-c30d-48cc-9243-875c99cdac98",
                          "name": "Multipass is not enabled for this store or the store is not on a Shopify Plus plan.",
                          "originalRequest": {
                            "method": "GET",
                            "header": [],
                            "url": {
                              "raw": "{{baseUrl}}/account/login/multipass/:token",
                              "host": [
                                "{{baseUrl}}"
                              ],
                              "path": [
                                "account",
                                "login",
                                "multipass",
                                ":token"
                              ],
                              "variable": [
                                {
                                  "key": "token"
                                }
                              ]
                            }
                          },
                          "status": "Forbidden",
                          "code": 403,
                          "_postman_previewlanguage": "text",
                          "header": [],
                          "cookie": [],
                          "responseTime": null,
                          "body": null,
                          "createdAt": "2026-06-05T13:18:45.000Z",
                          "updatedAt": "2026-06-05T13:18:45.000Z",
                          "uid": "35240-14e9a15b-c30d-48cc-9243-875c99cdac98"
                        }
                      ],
                      "createdAt": "2026-06-05T13:18:45.000Z",
                      "updatedAt": "2026-06-05T13:18:45.000Z",
                      "uid": "35240-dae09267-8761-40f5-905b-12e8886ed988"
                    }
                  ],
                  "id": "1c2b8b60-e69a-4b23-a845-8c9c821bc6e4",
                  "createdAt": "2026-06-05T13:18:45.000Z",
                  "updatedAt": "2026-06-05T13:18:45.000Z",
                  "uid": "35240-1c2b8b60-e69a-4b23-a845-8c9c821bc6e4"
                }
              ],
              "id": "1ffd4dd4-dd18-4cdd-a525-c7af74de49dd",
              "createdAt": "2026-06-05T13:18:45.000Z",
              "updatedAt": "2026-06-05T13:18:45.000Z",
              "uid": "35240-1ffd4dd4-dd18-4cdd-a525-c7af74de49dd"
            }
          ],
          "id": "0f8b8fba-1de4-48e7-b004-cbf24b8deaca",
          "createdAt": "2026-06-05T13:18:45.000Z",
          "updatedAt": "2026-06-05T13:18:45.000Z",
          "uid": "35240-0f8b8fba-1de4-48e7-b004-cbf24b8deaca"
        }
      ],
      "id": "9dbe79f8-50d9-4def-a43b-928224ad8e36",
      "createdAt": "2026-06-05T13:18:45.000Z",
      "updatedAt": "2026-06-05T13:18:45.000Z",
      "uid": "35240-9dbe79f8-50d9-4def-a43b-928224ad8e36"
    }
  ],
  "variable": [
    {
      "key": "store",
      "value": "my-store"
    },
    {
      "key": "baseUrl",
      "value": "https://{{store}}.myshopify.com"
    }
  ]
}