How to Provision Users Using Okta Workflows

Okta Workflows lets you build your own user provisioning for any app that exposes an API — even when there is no pre-built integration.

This article uses Shopify as an example. Shopify supports SCIM-based provisioning, but only on Shopify Plus — its most expensive plan. If you are on a lower-tier plan, you can use Okta Workflows to create, update, and delete Shopify customers automatically based on user lifecycle events in Okta.

The Automatically Sync Shopify Customer Identity template handles three lifecycle events:

• User added to an Okta group → create a customer in Shopify

• User profile updated in Okta → update the customer in Shopify

• User removed from an Okta group → delete the customer in Shopify

Before you begin

You need:

1. Okta org with Workflows

   1. Automatically Sync Shopify Customer Identity template

   2. An Okta connection configured in Workflows

   3. A Shopify connection configured in Workflows

2. Custom Okta user profile attributes (see next section)

Add the Automatically Sync Shopify Customer Identity template

1. Go to Templates in Workflows.

2. Search for Automatically Sync Shopify Customer Identity.

3. Click Add template, then follow the steps to select a folder to add the template to.

The template adds five flows and two tables to the selected folder:

 
Shopify template flows.

Create custom profile attributes

The template uses custom Okta user profile attributes to store Shopify-specific data. You need to create these attributes in your Okta user profile before using the template.

Flow 1: Create a customer in Shopify

This flow runs when a user is added to a specific Okta group. It creates a new Shopify customer and saves the Shopify Customer ID to the Okta user profile.

Create a customer in Shopify.

How the flow works

1. Okta — User Added to Group event triggers the flow when a user is added to a group.

2. Continue If checks that the group name matches the target group. The flow stops if it doesn't match.

3. Okta — Read User action retrieves the user's profile, including name, email, phone, and address.

4. Shopify — Create Customer action creates a new customer in Shopify using the user's profile data.

5. Shopify — Add Address to Customer action adds the user's address to the new Shopify customer record.

6. Okta — Update User action writes the Shopify Customer ID back to the shopify_customer_id attribute Okta user profile.

Flow 2: Update customer in Shopify

This flow runs when a user's Okta profile changes. It calls two helper flows to update the customer's profile and address in Shopify separately.

Update a customer in Shopify.

How the flow works

1. Okta — User Okta Profile Updated event triggers the flow when any profile attribute changes.

2. Call Flow calls Flow 2.1 to update the customer's profile in Shopify.

3. Call Flow calls Flow 2.2 to update the customer's address in Shopify.

Flow 2.1: Update customer profile in Shopify

This helper flow updates the customer's core profile fields in Shopify.

 
Update the customer profile in Shopify.

How the flow works

1. Okta — Read User action retrieves the user's current profile, including name, email, phone, and Shopify-specific attributes (shopify_accepts_marketing, shopify_tax_exempt, shopify_tags, shopify_customer_id).

2. Shopify — Update Customer action updates the customer record in Shopify with the retrieved values.

Flow 2.2: Update customer address in Shopify

This helper flow updates the customer's default address in Shopify. Shopify doesn't expose address updates through its standard Update Customer action, so this flow uses the Shopify REST API directly via the Custom API Action card.

Update a customer's address in Shopify.

How the flow works

1. Okta — Read User action retrieves the user's address fields (streetAddress, city, state, zipCode, countryCode) along with shopify_customer_id and shopify_default_address_id.

2. Object — Construct function builds the address payload — an address object with the field values wrapped in an address key, as required by the Shopify API.

3. String — Concatenate function builds the relative URL: /admin/api/2021-04/customers/{shopify_customer_id}/addresses/{shopify_default_address_id}.json.

4. Shopify — Custom API Action (PUT) sends the address update to the Shopify REST API.

5. String — Concatenate function builds a second URL: /admin/api/2021-04/customers/{shopify_customer_id}/addresses/{shopify_default_address_id}/default.json.

6. Shopify — Custom API Action (PUT) marks that address as the customer's default.

Flow 3: Delete customer in Shopify

This flow runs when a user is removed from the Okta group. It deletes the customer from Shopify and clears the Shopify Customer ID from the Okta user profile.

Delete a customer in Shopify.

How the flow works

1. Okta — User Removed from Group event triggers the flow when a user is removed from the group.

2. Okta — Read User action retrieves the shopify_customer_id from the user's profile.

3. Shopify — Delete Customer action deletes the customer from Shopify using the stored ID.

4. Okta — Update User action clears the shopify_customer_id attribute from the Okta user profile.

Summary

You can use this same pattern — lifecycle event → API call → store the ID — for any app that exposes an API. When a pre-built integration is not available or does not fit your plan, Okta Workflows gives you the flexibility to build your own.