Shopify merchants and developers constantly juggle customer data across native logins and third‑party identity providers like Google or Facebook. With the 2027‑01 release, Shopify introduces a powerful new GraphQL mutation—identityProviderSubjectDelete—that lets you programmatically unlink a customer from an external identity provider. This isn’t just a convenience; it’s a security‑focused tool that instantly signs the customer out of all active sessions, ensuring a clean break until they sign in again. In this post, we’ll break down what the mutation does, who needs to act, and how to integrate it into your apps or custom checkout flows.
What’s New: identityProviderSubjectDelete Mutation
As of API version 2027‑01, the GraphQL Admin API includes the identityProviderSubjectDelete mutation. You pass two identifiers: the Shopify customer ID (customerId) and the specific identity provider subject ID (id) you want to remove. The subject ID is retrieved from the Customer.identityProviderSubjects field, which lists every linked third‑party identity tied to that shopper. Once called, Shopify immediately revokes the link and signs the customer out of any open sessions—whether they’re on the storefront, POS, or mobile app. When the shopper later logs in via the same provider, the link is automatically re‑established, preserving a seamless experience after the intentional unlink.
Who Needs to Pay Attention
The primary audience is developers building custom apps, private apps, or integrations that manage customer authentication flows. If your app syncs Shopify customers with an external SSO or custom login system, you’ll want to use this mutation to enforce account hygiene, comply with GDPR “right to be forgotten,” or respond to security incidents. Merchants who rely on third‑party logins for loyalty programs, subscription services, or B2B portals also feel the impact—although they won’t call the API directly, they’ll notice the immediate sign‑out behavior and may need to update support scripts or staff training.
How to Use the Mutation
Below is a minimal GraphQL request you can drop into your Ruby, Node, or Python client. Replace the placeholder IDs with real values from your store. Remember: the mutation requires the write_customers access scope, so ensure your app’s OAuth token includes it.
graphql
mutation UnlinkIdentityProvider($customerId: ID!, $subjectId: ID!) {
identityProviderSubjectDelete(customerId: $customerId, id: $subjectId) {
userErrors {
field
message
}
deletedIdentityProviderSubjectId
}
}
Step‑by‑step implementation
identityProviderSubjects list.id of the subject you want to remove (e.g., the Google OAuth sub).identityProviderSubjectDelete mutation with the customer’s global ID and the subject ID.userErrors returned—common issues include missing write_customers scope or an invalid subject ID.Impact on Customer Sessions
One of the most noticeable side effects is an immediate sign‑out across all devices. Shopify invalidates the session tokens tied to the now‑unlinked identity provider, which means any open browser tabs, mobile apps, or POS sessions will redirect to the login page. This behavior is intentional—it prevents a stale link from being exploited after a revocation. Merchants should be aware that customers may see a sudden “You’ve been signed out” banner; communicating this in advance (e.g., via email or an in‑app notice) can reduce confusion.
Testing and Validation
Before rolling out to production, test in a development store:
graphql
{ customer(id: "gid://shopify/Customer/123456789") {
identityProviderSubjects { id provider }
}
}
These steps confirm both the unlink and re‑link pathways work as expected.
Best Practices and Gotchas
write_customers. Double‑check your OAuth scopes during app installation.deletedIdentityProviderSubjectId. Guard against unnecessary calls by first checking the subject list.deletedIdentityProviderSubjectId) in your logs. This aids GDPR compliance and helps you trace who performed the unlink.Next Steps for Merchants and Developers
Developers: Update your authentication micro‑services to call identityProviderSubjectDelete whenever you need to revoke a third‑party link—whether due to a data‑privacy request, a compromised OAuth token, or a business rule change. Test thoroughly, log outcomes, and ensure your OAuth app requests the write_customers scope.
Merchants: Communicate with your support team about the new sign‑out behavior. If you rely heavily on social logins for loyalty or subscription access, draft a brief FAQ explaining why a shopper might be asked to log in again after you’ve unlinked their account.
By adopting this mutation early, you’ll keep customer data clean, meet compliance mandates, and maintain a secure shopping experience across all channels.
