One account, guarded in one place.

Sign-in is Shopify’s

Customers sign in through Shopify’s Customer Account API, with PKCE and the verifier kept on the server. RedeemID checks the returned ID token’s issuer, audience, expiry and nonce before signing anyone in, and never sees how a customer signs in to Shopify.

A customer new to your site gets a WordPress user with no usable password, no password reset and no wp-admin. An existing WordPress user who links their account keeps their WordPress login, so the site’s own password rules still apply to them. Administrators can never be linked or sign in through Shopify.

What moves to Shopify

One account now opens your store and your site. Shopify usually signs customers in with a one-time code sent to their email, so a customer’s inbox is the key to both. Disabling a customer in Shopify takes away their members-only access once Shopify’s webhook arrives. See One customer account for the limits.

What WordPress keeps

• Shopify tokens are stored encrypted inside the customer’s WordPress session. No page, script or REST route returns one, and they are removed on disconnect and erasure.
• App secrets entered in Settings are encrypted with libsodium and never shown again. A constant in wp-config.php keeps a secret out of the database altogether. See Configuration.
• Every webhook’s signature is checked before anything is saved. A delivery that fails the check is rejected and flagged on the admin screens.
• The app event log keeps 30 days of Shopify calls without request bodies, tokens or secrets.

Shopify’s own plugin

Shopify’s WordPress plugin, version 1.0.0 and earlier, is named in a published advisory (CVE-2026-57748, local file inclusion), and it has had no release since. RedeemID covers what it does, so a site can remove it. See Moving off Shopify’s WordPress plugin.