Unlink a customer's identity provider subject with the GraphQL Admin API
Source: Shopify Dev Changelog
Shopify Admin API Adds Mutation to Unlink Customer Identity Provider Subjects
What Changed
Shopify has introduced a new mutation, identityProviderSubjectDelete, in the GraphQL Admin API as of API version 2027-01. This mutation allows developers to unlink a customer from a third-party identity provider programmatically.
To use the mutation, developers must pass two parameters: the customer’s ID as customerId and the identity provider subject’s ID as id. Subject IDs can be retrieved from the Customer.identityProviderSubjects field. The mutation requires the write_customers access scope.
When executed, the mutation signs the customer out of all active sessions immediately. If the customer subsequently signs in again through the same identity provider, the account is automatically re-linked.
Why This Matters for App Developers
This addition gives developers direct control over customer authentication relationships tied to external identity providers, such as those used in B2B single sign-on (SSO) configurations or third-party authentication integrations. Previously, unlinking these connections required manual intervention or lacked a programmatic path through the Admin API.
For apps managing customer accounts, access control, or authentication workflows, this mutation closes a gap in identity management capabilities, particularly relevant for merchants using custom identity providers alongside Shopify’s customer account system.
Practical Implications
Developers building customer management tools or account security features should review how session invalidation affects their app’s logic, especially for apps that cache authentication state or session tokens. Since unlinking forces a full sign-out across all sessions, apps should account for this when designing account recovery, security auditing, or admin-initiated unlinking features.
Developers working with identity provider integrations should update to API version 2027-01 to access this mutation and verify that their app’s scope permissions include write_customers.