How to Resolve: Shopify “Customer Account” login loop on Mobile

A customer account login loop on mobile occurs when shoppers attempt to sign in to their account on an iPhone, Android, or tablet, but the screen constantly refreshes and redirects them back to the login prompt. The customer never reaches their order history, saved addresses, or subscription portal.

This issue is primarily caused by aggressive third-party cookie blocking in mobile browsers (such as Apple’s WebKit ITP on mobile Safari), configuration mismatches between Classic and New Customer Accounts, or third-party loyalty/redirect apps intercepting the /account route.

How do I fix the Shopify mobile customer account login loop?

To resolve a customer account login loop on mobile devices, verify whether your store uses Classic or New Customer Accounts under Settings > Customer accounts, ensure your primary custom domain SSL certificate is active, clear corrupted mobile Safari/Chrome session cookies, and remove conflicting third-party geolocation or loyalty redirect scripts from the account layout template.

---

Fast Diagnostic Snapshot

Property	Diagnostic Metric
Device Environment	Mobile Safari (iOS), Mobile Chrome (Android), In-App Browsers (Instagram/TikTok)
Observed Loop	/account/login ⇄ /account (User enters credentials, page reloads blank login form)
Primary Root Cause	Mobile browser cookie restrictions (Apple ITP) dropping cross-domain session cookies
Secondary Root Cause	Loyalty, subscription, or translation app injecting automated redirect loops on /account
Admin Route	Shopify Admin > Settings > Customer accounts

---

Classic vs. New Customer Accounts: The Authentication Shift

Shopify provides two distinct customer account architectures:

AUTHENTICATION ARCHITECTURES:

1. CLASSIC CUSTOMER ACCOUNTS:
   - Uses customer email + customer-created password.
   - Operates on: yourstore.com/account/login
   - Relies on traditional first-party session cookies.
   - Vulnerable to theme script interference and mobile cookie drops.

2. NEW CUSTOMER ACCOUNTS:
   - Passwordless login (receives a secure 6-digit code via email/SMS).
   - Operates on: shopify.com/your-store-id/auth or accounts.yourstore.com
   - Runs in an isolated, secure Shopify authentication container.
   - Bypasses theme Liquid bugs, but requires correct domain verification.

If your store switches back and forth between these architectures, or runs custom theme code designed for Classic accounts while New Customer Accounts are enabled, mobile browsers will loop indefinitely.

---

Root Causes and Step-by-Step Fixes

1. Mobile WebKit and ITP Cookie Stripping

Apple’s WebKit engine (which powers all web browsers on iOS, including Safari, Chrome, and Firefox on iPhones) enforces Intelligent Tracking Prevention (ITP).

If your primary domain and Shopify’s checkout/login endpoint operate on slightly different subdomains or fail canonical domain alignment, Safari treats the session cookie as third-party tracking data and deletes it instantly. The customer submits their login form, the server sets the session cookie, Safari drops the cookie, and the server redirects the unauthenticated user back to /account/login.

The Fix:

1. Navigate to Shopify Admin > Settings > Domains.
2. Confirm that your primary domain has an active SSL badge.
3. Ensure traffic is set to Redirect all traffic to this domain (e.g., all http://, https://yourstore.com, and myshopify.com traffic routes through https://www.yourstore.com).
4. If your SSL certificate is degraded, pending, or showing errors on mobile handshakes, follow the remediation steps in How to Resolve: Shopify “Domain Not Verified” SSL Handshake Failure.

2. Upgrading to New Customer Accounts to Eliminate Password Loops

If your store is on Classic Customer Accounts, legacy form inputs, automated bots, and mobile password managers can get trapped in credential mismatch loops. Migrating to New Customer Accounts replaces passwords with one-time verification codes, eliminating password-related loop errors.

The Fix:

1. In Shopify Admin, open Settings > Customer accounts.
2. Locate the Account version card.
3. Click Edit.
4. Select New customer accounts.
5. Choose your login experience:
   • Use Shopify’s managed domain or set up a custom branded authentication subdomain (e.g., accounts.yourstore.com).
6. Click Save.
7. Test the flow on an iPhone using mobile Safari. The user enters their email, receives a 6-digit code, enters it, and is authenticated directly into their portal without password evaluation.

3. In-App Mobile Browser (Instagram, TikTok, Facebook) Webview Traps

A high percentage of mobile shopping traffic originates inside in-app webviews (when a user clicks a link inside Instagram, TikTok, or a Facebook ad).

In-app webviews operate in a sandboxed, restricted storage state. They frequently block cookies, ignore saved password managers, and fail to hand off tokens to external identity providers.

The Fix:

1. In your theme’s layout/theme.liquid, check if you have custom scripts forcing customers to log in before viewing specific pages.
2. If you operate a members-only store, ensure that your redirect logic does not loop when no customer object is detected.
3. Ensure your site does not force external pop-up windows for authentication, as in-app webviews routinely suppress new browser windows.
4. If your store was recently placed behind a storefront password and exhibits looping behavior across both accounts and pages, check Fix: Shopify “Redirect Loop” after enabling Password Protection.

4. Third-Party Loyalty, Subscription, or Geolocation Script Conflicts

Many Shopify apps—especially customer loyalty portals (Smile, Yotpo, LoyaltyLion), wholesale lock apps, and subscription managers (Recharge, Skio)—inject redirect scripts directly into the account page.

If an app script runs in the <head> of customers/account.liquid and expects a specific customer metafield or subscription tag that the customer does not have, it will trigger an automated JavaScript redirect (e.g., window.location.href = '/pages/subscribe'). If that target page requires login, the customer bounces back to /account/login, generating a continuous loop.

The Fix:

1. Navigate to Online Store > Themes > Actions > Edit code.
2. Open templates/customers/account.liquid (or templates/customers/login.liquid).
3. Inspect the file for custom <script> tags injected by apps or developers.
4. Look for redirect commands: // Dangerous script redirect causing mobile loops if (!customer.tags.includes('approved')) { window.location.href = '/account/login'; }
5. Remove or comment out the rogue JavaScript redirect.
6. Test logging in on a mobile device to confirm that the standard dashboard renders cleanly.

---

Verifying Mobile Session Storage in Developer Tools

If you do not have an active mobile device to reproduce the loop, you can emulate mobile session behavior on desktop:

1. Open Google Chrome on your computer.
2. Press F12 to launch Developer Tools.
3. Click the Toggle device toolbar icon (the phone/tablet icon in the top left of DevTools) and select iPhone 14 Pro or Pixel 7.
4. In DevTools, click the Network tab and check Preserve log.
5. Attempt to log in to the storefront account page.
6. Observe the network redirect chain:
   • If you see continuous 302 Found status codes alternating between /account/login and /account, inspect the Cookies tab under Application > Cookies.
   • If the _shopify_s or customer_auth session cookies are missing or have an expired timestamp, your mobile browser is rejecting the cookie header. Verify your canonical domain routing to resolve the issue.

If customer checkouts hang or freeze following account authentication, see Fix: Shopify “Checkout is currently unavailable” (High-Traffic Error).