customer_authentication/login always sends prompt=login to external IdP, docs say prompt=none

[zmolly]

Summary

/customer_authentication/login?login_hint=<email>&return_to=<path> always sends prompt=login to the configured external OIDC Identity Provider (Clerk), even though Shopify's documentation implies it should attempt prompt=none (silent authentication) first and fall back to interactive on IdP error.

Environment

• Store: Shopify Plus, customerAccountsVersion: NEW_CUSTOMER_ACCOUNTS
• External IdP: Clerk (OIDC, confidential client, consent screen disabled)
• Storefront: Hydrogen (headless) on Vercel
• Customer account domain: account.avnzor.com
• Checkout domain: shop.avnzor.com

Steps to reproduce

1. Configure an external OIDC IdP (Clerk) for new customer accounts
2. Ensure the user has an active session on the IdP (verified via the IdP's Account Portal)
3. Navigate to: https://shop.avnzor.com/customer_authentication/login?login_hint=user@example.com&return_to=/
4. Observe the redirect chain

Expected behavior

Per documentation, the endpoint should first attempt prompt=none against the IdP. If the IdP returns error=login_required, fall back to prompt=login (interactive).

Actual behavior

The endpoint always sends prompt=login to the IdP — no prompt=none attempt is made. This was verified by:

1. Capturing the redirect URL in the browser's tab context (the Clerk authorize URL clearly contains prompt=login)
2. Testing 3 times with a confirmed-active IdP session — prompt=login every time
3. Independently confirming that the IdP does honor prompt=none when called directly (issues an auth code silently with no UI)

Impact

This forces a double sign-in for headless storefronts using an external IdP:

1. User signs in on the headless storefront (via the IdP's embedded components)
2. At checkout / "My Orders", Shopify redirects to the IdP with prompt=login
3. IdP shows a full sign-in form despite the user having an active session
4. User must authenticate again

With prompt=none, step 3 would complete silently (the IdP already has the session), and the user would never see a second sign-in form.

Workaround attempted (failed)

We built a server-side proxy that follows the redirect chain, finds the IdP's authorize URL, and rewrites prompt=login → prompt=none. The silent auth code issuance worked, but Shopify's token exchange failed ("Access token request error") because the server-side fetch didn't forward Shopify's session cookies to the browser.

Request

Either:

1. Fix the endpoint to try prompt=none first (as documented), or
2. Add a configuration option (e.g., prompt=auto query parameter, or a shop-level setting) that controls the prompt behavior for external IdPs