I’m working on an Elixir implementation of Shopify’s Multipass feature – it’s basically a single-sign-on (SSO) flow that lets your app handle authentication, and on success, it produces a URL that when clicked will cause a customer record to be upserted into Shopify. They include working examples of how to do this in PHP and Ruby, but I cannot make it work in Elixir.

You have to enable the feature and they give you a 32 character shared secret key.

# Example key from Shopify Admin
multipass_secret = "1234567890abcdef1234567890abcdef"

customer_data = %{
  email: "test@test.shopify.com",
  created_at: DateTime.to_iso8601(Timex.now()),  # <-- the token will only be valid for a small timeframe around this timestamp.
}

key_material = :crypto.hash(:sha256, multipass_secret)
# Split the key into 2 binaries each containing exactly 16 bytes
<< encryption_key::binary-size(16), signature_key::binary-size(16) >> = key_material

customer_data_as_string = Jason.encode!(customer_data)

# Initialization Vector
ivec = :crypto.strong_rand_bytes(16)

to_add = 16 - rem(byte_size(customer_data_as_string), 16)
padded = customer_data_as_string <> :binary.copy(<<to_add>>, to_add)

cipher_text = ivec <> :crypto.block_encrypt(:aes_cbc128, encryption_key, ivec, padded)
signature = :crypto.hmac(:sha256, signature_key, cipher_text)
message = cipher_text <> signature

token = Base.encode16(message, case: :lower)

"https://yourstore.myshopify.com/account/login/multipass/#{token}"

Note that this feature is only available in Shopify Plus accounts.

Links I’ve been pouring over:

• crypto — OTP 29.0.2 (crypto 5.9)
• https://stackoverflow.com/questions/37629194/how-to-encrypt-and-decrypt-with-aes-cbc-128-in-elixir

Does anyone have some pointers on converting this? Thanks!