Recommended Playwright approach for automating logged-in Shopify checkout with New Customer Accounts

GraphQL Admin API Troubleshooting
1

We are building a TypeScript Playwright test automation framework for a Shopify development store. The framework runs locally using Microsoft Edge and will run unattended through Bitbucket Pipelines.

The store uses Shopify New Customer Accounts. We need to automate an actual logged-in customer checkout, including:

  1. Creating or selecting a dedicated test customer.
  2. Authenticating Playwright as that customer.
  3. Creating a cart and associating it with the authenticated customer.
  4. Opening Shopify’s hosted checkout.
  5. Confirming checkout recognizes the logged-in customer.
  6. Selecting a delivery method.
  7. Completing payment through Shopify’s test payment gateway.
  8. Verifying the resulting order through the Admin API.

We have access to:

  • Shopify Admin GraphQL API
  • Shopify Storefront GraphQL API
  • Shopify Customer Account API
  • Playwright with TypeScript

New Customer Accounts uses passwordless email authentication with an OTP. Manually entering OTP codes and maintaining manually generated Playwright storageState files is not suitable for reliable, unattended CI execution.

What is Shopify’s officially supported approach for implementing this test using Playwright?

Specifically:

  • Can a dedicated automation customer be authenticated programmatically without manually retrieving an OTP?
  • Can a Customer Account API OAuth token be supplied to Playwright or associated with a Storefront API cart so hosted checkout recognizes the customer?
  • Does Shopify provide a test-only authentication mechanism for New Customer Accounts?
  • Is there an API-to-browser handoff recommended for Playwright checkout automation?
  • Can Multipass be used with New Customer Accounts for this purpose, or is it limited to legacy customer accounts or particular Shopify plans?
  • What is the recommended way to run this test unattended in CI?
  • If logged-in checkout cannot be automated on a standard development store, which Shopify store type or test environment should be used?

We can use Playwright API fixtures for setup, the browser for hosted checkout, and the Admin API for post-checkout verification.

We are not looking for an Admin API orderCreate solution because a backend-created order does not exercise the customer login, cart, delivery, payment, or hosted-checkout journey.

2

Hey @Ramitha_Silva - thanks for laying this out so clearly.

I’m looking into the CI-specific authentication question, but I can confirm several parts of your questions from the current documentation:

  • A Customer Account API access token can be passed as buyerIdentity.customerAccessToken when creating or updating a Storefront API cart. Opening that cart’s checkoutUrl authenticates the customer for that specific checkout, so you don’t need to create a Customer Accounts browser session or Playwright storageState: Authenticate buyers in checkout
  • The cart setup is documented here: Create and update a cart with the Storefront API
  • sso=silent is a separate option that checks for an existing Customer Accounts browser session. It isn’t needed for the cart-token approach.
  • The initial Customer Account OAuth authorization is still an interactive customer sign-in. I haven’t found a documented public test-only mechanism that bypasses the email code: Customer Account API reference
  • Customer Account clients configured through the Headless or Hydrogen channel receive refresh tokens. App-specific customer-authentication clients don’t. Those clients can use prompt=none only while a Shopify browser session remains active, so it isn’t suitable for unattended CI: Getting started with the Customer Account API
  • Multipass is currently documented as a Shopify Plus feature for legacy customer accounts, not Customer Accounts. New stores can no longer choose to use legacy Customer accounts as of this February 2026 changelog post: Multipass
  • A development store can process test orders through Shopify’s Test/Bogus gateway or a payment provider’s test mode: Dev stores
  • The completed order can then be queried through the Admin GraphQL API: orders - GraphQL Admin

I’m looking into whether Shopify recommends securely retaining a Headless customer refresh token for this external CI use case, what can invalidate it, and whether another interactive sign-in may eventually be required. I’ll follow up here once I have that answer.

Hope this helps in the meantime!