Recommendation for User and Accounts flow

Extensions
1

We are implementing a B2B portal in Shopify for DHL / Gate Gourmet using Shopify Grow and New Customer Accounts.

Our requirement is to have:

  • Standard username/password login authentication

  • Custom Login page

  • Custom Register page

  • Custom Reset Password page

  • User approval flow before account activation

  • Role/tag based storefront access using Locksmith

  • Multiple users mapped to multiple ship-to addresses and port locations

Current issue:
Shopify New Customer Accounts are passwordless by default and Legacy Customer Accounts are deprecated. Since DHL requires standard login authentication with username and password, we are trying to understand the best possible implementation approach.

Questions:

  1. Can we fully replace the New Customer Account UI with custom login/register/reset password forms?

  2. Will custom forms override the native passwordless authentication flow?

  3. Is it possible to implement traditional email + password authentication using Shopify New Customer Accounts?

  4. Would this require a headless/customer-account-api based implementation or an external authentication system?

  5. Can customer metafields/metaobjects be used for storing additional registration data such as port locations, ship-to addresses, user roles, etc.?

  6. Has anyone implemented a similar approval-based B2B authentication flow in Shopify Grow?

Any recommended architecture or app suggestions would be helpful.

2

When using the new customer account option, the ONLY way to override the native passwordless login/registration flow would be using a custom identity provider, however this is only available on Shopify Plus.
https://help.shopify.com/en/manual/customers/customer-accounts/sign-in-options/identity-provider

The other option would be to consider going headless which I believe would allow you to build your own registration/login system.

There are some workarounds for having custom registration/application forms other places on your site, but if replacing the native passwordless system is a strict requirement then your option would be essentially limited to headless.