Sign in with Google or Microsoft
You can sign in, or sign up, with a Google or Microsoft account instead of setting a password.
Where the buttons are
They sit below the email and password form on the sign-in and sign-up screens, after a divider reading “Or”. Each button shows only the provider’s logo; its name, Continue with Google or Continue with Microsoft, appears when you point at it and is what a screen reader announces.
A provider only appears when the platform has been configured for it. If you do not see a button for your provider, it has not been switched on yet, not that your account is ineligible.
Underneath, on both screens, a consent line tells you that continuing this way means accepting the “Privacy Policy” and the “Terms of Service”. Both open in place. If you have no account yet, continuing from either screen creates one, which is why the line is on both.
What happens next
Choosing a provider sends you to that provider to sign in. They then send you back to a return page in the app at /auth/callback/google or /auth/callback/microsoft, which finishes the job and issues your session.
The return page runs before the app shell loads, because it is the thing that creates your session in the first place.
The return must land in the same browser tab that started the sign-in. That tab holds a one-time secret, and the page refuses a return it did not start, with a message saying the sign-in did not start in this browser. This stops someone else’s sign-in link from signing you into their account. If your browser blocks site storage, the button tells you before you leave, and you can sign in with your email instead.
Which accounts can be used
- Google: the account’s address must be one Google has verified.
- Microsoft: personal Microsoft accounts always qualify. A work or school account qualifies when Microsoft confirms its organisation owns the address’s domain.
If the address is not confirmed this way, the provider cannot open an account for it or join it to one that already exists. You are asked to use your email and password instead.
If you already have an account with the same address, the first provider sign-in joins it to that account and we email you that it was added. This needs proof that the account, and not only the address, is yours: a password reset, an invitation, or the account having been created through Google, Microsoft or the Shopify app. The confirmation link sent when an account is created proves the address but not the password, because whoever created the account chose it. Without that proof, you are asked to reset the password first: someone else could have created that account with your address, and joining it would hand you an account whose password they set.
If your account has two-factor authentication, the provider is joined only after you enter your code. Stopping at the code step leaves nothing joined.
If you get that email and it was not you, contact support. Changing your password does not remove a joined provider; support can.
If your account also has a second factor
Signing in with a provider proves who you are to Google or Microsoft, not to us. If your account has two-factor authentication on, the return page asks for your authenticator code before it lets you through, with a line explaining that you have signed in with the provider and need the code to finish.
If two-factor authentication is required for your account but not yet set up, the return page takes you straight to setting it up. You get no session until it is done.
If it does not work
If you sit on the provider’s screen too long, the attempt expires. The page tells you so and offers “Back to sign in” rather than leaving you stuck.
If the provider reports an error, the page says the provider could not complete the sign-in. It never repeats text from the link, because anyone can write that text.
If the sign-in could not be started at all, you are told and can simply try again. Nothing is left half-created on our side.
Accounts with no password
An account created this way has no password. You can add one at any time through the forgot-password link on the sign-in screen. Closing the account asks you to type a confirmation word rather than a password.
Closing the account also removes its Google and Microsoft links, and your data export lists them.