--- title: Provisioning Shopify with PingOne description: Provision users from PingOne to Shopify. component: pingone page_id: pingone:integrations:p1_provisioning_connection_shopify canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_provisioning_connection_shopify.html llms_txt: https://docs.pingidentity.com/pingone/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: before-you-begin: Before you begin steps: Steps shopify-attribute-mapping: Shopify attribute mapping limitations: Limitations user-profile-updates: User profile updates group-and-role-management: Group and role management provisioning-direction: Provisioning direction duplicate-users: Duplicate users --- # Provisioning Shopify with PingOne Shopify is a commerce platform that supports System for Cross-domain Identity Management (SCIM) 2.0 provisioning for Shopify Plus organizations. By using the Shopify connection in PingOne, you can provision users and selected role or membership assignments from PingOne to Shopify. The Shopify connection is outbound only. Changes made directly in Shopify are not synchronized back to PingOne. | Resource | Capability | Description | Inbound | Outbound | | ------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------- | -------- | | User | Create | Creates a Shopify SCIM user. | No | Yes | | | Read | Reads users and their current state. | No | Yes | | | Update | Limited support. Users can be activated or deactivated, but attributes such as username and email cannot be updated. | No | Limited | | | Deactivate or reactivate | Changes the SCIM `active` state. | No | Yes | | | Delete | Deletes a user when the selected remove action and Shopify behavior allow it. | No | Yes | | Group or role | Create, rename, or delete | Group and role objects are not managed by this connector. | No | No | | Membership | Add or change | Creations and updates are fully supported. | No | Yes | | | Remove | Membership removal is supported only by deactivating the user. | No | No | Configure Shopify provisioning to synchronize users and selected membership assignments from PingOne to a Shopify Plus organization. ## Before you begin Make sure you have: * A Shopify Plus organization with SCIM provisioning enabled. * The Shopify SCIM service URL for the organization. The tested endpoint is . * A Shopify SCIM API token. Treat the token as a secret. * A PingOne population or group containing the users that you want to provision. * Shopify groups or roles created before membership provisioning in Shopify tenant. The Shopify connection cannot create, rename, or delete these objects. * Matching group names and casing in PingOne and Shopify. Shopify uses the mapped group name as the role value. ## Steps Create a Shopify connection by completing the following: 1. In the PingOne admin console, go to **Integrations > Provisioning**. 2. Click **[icon: plus, set=fa]**and then click **New Connection**. 3. Click **Select** for **Identity Store**. 4. On the **Shopify** tile, click **Select**. Click **Next**. 5. Enter a **Name** and **Description** for this provisioning connection. 6. Click **Next** 7. In the **Configure Authentication** section, select **Token Authentication** and enter the following Shopify connection values: | Field | Value | | ------------------------- | --------------------------------------------------------------------------------------- | | **Service URL** | The Shopify SCIM service URLFor example: `https://shopifyscim.com/scim/v2` | | **Authentication method** | `TOKEN` | | **SCIM token** | The Shopify SCIM API tokenFor example: `ptkn_85c565975636f55b648fe9b0df6a97802263e63…​` | 8. Click **Test connection** to verify that PingOne can establish a connection to Shopify. 9. In **User Actions**, configure the lifecycle actions that you need: * Create users * Update users, with the limitations described in this document * Disable users * Deprovision users * Deprovision users on rule deletion * Remove action: choose **Disable** for reversible deprovisioning or **Delete** when permanent deletion is intended and supported by your policy 10. Click **Save**. 11. Enable the connection using the toggle in the details panel. Create an outbound provisioning rule by completing the following: 1. Create an [outbound](p1_create_provisioning_rule_outbound.html) rule and select the Shopify connection as the target. 2. Select the PingOne population or group whose users should be provisioned. 3. Add attribute mappings for the fields that you want to synchronize. 4. Configure membership mapping only after the corresponding Shopify groups or roles exist. 5. Click **Save** and enable the rule. ### Shopify attribute mapping Use the following outbound mapping examples for the Shopify connection: | PingOne Directory | Shopify connector attribute | Purpose | | ----------------- | --------------------------- | ---------------------------------------------------------------- | | Email Address | `email` | Primary email address and source for the Shopify SCIM `userName` | | Given Name | `firstname` | User's first name | | Family Name | `lastName` | User's last name | | Enabled | `active` | Controls the user's active state | | Group names | `roles` | Assigns a Shopify role or group name | The Shopify implementation derives the target SCIM `userName` from the synced email. There is no separate username mapping in the connection. Keep the email and username values stable after creation whenever possible. For membership provisioning, map **Group Names** to `roles`. The Shopify group name must already exist and must match the PingOne group name and casing. A group can contain multiple users, but rights to a user's Shopify roles have the limitations described in membership provisioning behavior. ## Limitations The following limitations apply to the Shopify provisioning: ### User profile updates * Users can be created successfully, but their first name, last name, email address, and username cannot be reliably changed afterward. The update might appear successful, but the old values remain. * Deactivating or reactivating a user works when performed by itself. However, if it is done together with other profile changes, the status change might not take effect. ### Group and role management * The connection cannot create, rename, or delete Shopify groups or roles because **Group sync** support is not present. * One user can only have one membership in Shopify but multiple users can be part of one group. * Removing a membership in PingOne doesn't remove it from Shopify. To remove the membership, the user needs to be deactivated. * If a Shopify group associated with a user is deleted directly in Shopify, the next synchronization will fail instead of simply removing the membership. ### Provisioning direction * The connection supports outbound provisioning only, from PingOne to Shopify. * Changes made directly in Shopify are not synchronized back to PingOne. * Two-way synchronization is not supported. ### Duplicate users * If a user with the same username or email already exists, Shopify returns the existing user instead of creating a new one. * The operation might still appear successful, so it can be difficult to determine whether a new user was created or an existing user was reused.