Customer sign-in with Toki

The customer identity provider lets customers use their Toki account to sign in to any compatible OIDC client, including Shopify customer accounts. You generate a set of credentials once, enter them in your OIDC client, and paste the client's URLs back into Toki. From then on, customers can sign in with the same methods they use for your loyalty wallet.

During sign-in, Toki shares a unique customer ID, the customer's email address, and their first and last name when they have entered them. Nothing else from their loyalty account, such as points or tiers, is shared.

Where to find it

Open Integrations.
On the Shopify row, click Manage.
Scroll to the Customer identity provider section. The badge next to the title shows the current status.

Before you start

Your loyalty wallet must offer at least one sign-in method that Toki runs itself. In Design, click Edit on the Wallet module, open the Auth Screen section, and check that Login authorization type includes Magic Link, Auth code, Social Login, or Email & Password. Customers use one of these methods to sign in to Toki.
Leave the Multi Pass Token field on the Manage Shopify page empty. Toki signs customers in through either the identity provider or Shopify Multipass, never both at the same time. See Identity provider or Shopify Multipass.

Step 1: Generate credentials

In the Customer identity provider section, click Generate OIDC credentials.
Copy the Client secret right away. Toki shows it only once, in a notice that reads "Copy this client secret now. It will not be displayed again." Use the Copy button next to it.

The status changes to Draft, and the section now shows two numbered groups of fields.

Step 2: Enter the Toki values in your OIDC client

The group 1. Enter these Toki values in your OIDC client lists the values your client needs. Each field has a Copy button, and the field names match the setup fields of a typical OIDC client.

Field in Toki	What to do with it
Well-known or discovery endpoint URL	Paste it into your client's discovery URL field.
Client ID	Paste it into your client's client ID field.
Client secret	Paste the secret you copied in step 1.
Additional scopes (other than openid and email)	Add the scope shown, `offline_access`, to your client's scopes.
Post-sign-out redirect URI parameter name	Enter the value shown, `post_logout_redirect_uri`, if your client asks for it.

Step 3: Copy your client's URLs into Toki

Your OIDC client shows the URLs it uses to finish a sign-in and a sign-out. Enter them in the group 2. Copy these URLs from your OIDC client into Toki.

Paste the client's callback URLs into Callback URLs, one per line.
Paste the client's sign-out URLs into Sign-out URLs, one per line.
Click Save in the bar at the top of the page.

Enter at least one URL in each field. Every URL must start with https:// and match what your client shows, character for character. After you save, the status changes to Ready to test.

Set up Shopify customer accounts

Shopify customer accounts work as an OIDC client. Here is the full flow in Shopify terms.

In Toki, generate credentials as described in step 1.
In your Shopify admin, open Settings, then Customer accounts, and find the identity provider settings.
Select Custom or other as the provider.
Paste the Toki values from step 2: the discovery URL, the Client ID, the Client secret, the additional scope offline_access, and the post-sign-out redirect URI parameter name post_logout_redirect_uri.
Copy the callback and sign-out URLs Shopify shows you, paste them into Callback URLs and Sign-out URLs in Toki, and click Save.
Back in Shopify, run Test connection.

Shopify's own guide to customer accounts is at help.shopify.com.

Statuses

Status	What it means
Not configured	No credentials yet. Click Generate OIDC credentials to start.
Draft	Credentials exist. Callback and sign-out URLs are not saved yet.
Ready to test	URLs are saved. Toki is ready for a sign-in from your OIDC client.
Active	A sign-in has completed through Toki.
Disabled	You turned the provider off. Toki no longer signs customers in.

Rotate the client secret

Rotate the secret whenever you want a fresh one, for example after a team member who knew it leaves.

Next to Client secret, click Rotate secret.
Copy the new secret from the notice. As with the first secret, Toki shows it only once.
Paste the new secret into your OIDC client.

The previous secret keeps working for 24 hours after you rotate, so customer sign-ins continue while you update your client.

Disable the provider

Click Disable provider at the bottom of the section. The status changes to Disabled, Toki stops signing customers in, and sign-in access that Toki granted earlier is revoked. Your credentials and URLs stay in place.

Identity provider or Shopify Multipass

Toki offers two ways to connect customer sign-in with Shopify: the identity provider described here, and Shopify Multipass, set up through the Multi Pass Token field on the same Manage Shopify page. Use one or the other.

To use the identity provider, keep Multi Pass Token empty. If a token is saved, Toki shows a notice and keeps the identity provider controls read-only until you remove it.
While the identity provider is Draft, Ready to test, or Active, the Multi Pass Token field is read-only. Click Disable provider first if you want to switch to Multipass.

Integrations and API key