The problem
A premium retailer partnered with Delta Air Lines wanted SkyMiles members to sign in to its Shopify store with their existing Delta credentials, and get access to member-specific discounts and offers.
That meant joining two separate platforms, meeting a major airline's security requirements, and making the handover invisible to the customer.
What we built
- Standards-based sign-in. OpenID Connect with PKCE, cryptographically secure state, and JWT validation.
- Member data sync. Basic profile details and SkyMiles status passed securely to the store, so customers are recognised and tagged correctly.
- Shopify integration. Multipass tokens that sign customers in and create their accounts automatically.
- Graceful failure. Clear messages and alternative paths when something goes wrong, with detailed logging for troubleshooting.
The hard parts
Security and simplicity pull in opposite directions here. The flow needed protection against cross-site request forgery and replay attacks, while keeping redirects to a minimum and handling edge cases such as accounts that already shared an email address.
What changed
Members get single sign-on and recognition of their status, with less friction at registration and login. The retailer gets enterprise-grade authentication, and consistent identity across both platforms.