Shopify staff accounts and permissions: who can do what

Types of users in a Shopify store

A store has an owner, the account with full control, including billing and the ability to transfer or close the store. Below that are staff accounts, which are the people on your team, and collaborator accounts, which are designed so agencies and developers in the Shopify Partners program can work on your store with limited permissions.

How many staff accounts your plan includes depends on the plan, and Shopify updates it from time to time, so check the figure on Shopify's pricing page. If your plan falls short, that is a legitimate reason to upgrade, and much better than sharing passwords.

Sharing a single account among several people seems convenient until something breaks. You lose the record of who made each change, you can't remove one person's access without changing the password for everyone, and two-step authentication ends up tied to the phone of someone who may no longer be around. With individual users, every admin action is linked to a specific person and each departure is handled without affecting the rest of the team.

Roles and permissions: how they work

A role groups the permissions a person needs to do their job. Shopify comes with predefined roles, such as merchandiser, and you can create your own under Settings > Users > Roles. You can assign several roles to each user, and their permissions are the sum of all of them.

Permissions are granular: view orders, edit products, manage discounts, view reports, install apps, edit the theme and so on for almost every section of the admin. Which roles and permissions are available depends on your plan, whether the store belongs to an organization, whether you're on Shopify Plus and whether you use POS Pro at your locations.

• Customer service: orders, customers and returns
• Catalog: products, collections and inventory
• Marketing: discounts, campaigns and store content
• Management or finance: reports and analytics
• Development: themes and apps, without access to customer data unless needed

Collaborators: how to give an agency access

When you work with an agency or a freelancer who is a Shopify Partner, the right way is to give them collaborator access, not create a staff account for them and certainly not hand over your login. The collaborator requests access from their Partner dashboard and you decide which permissions to grant.

Under Settings > Users > Security you control how collaborators are accepted and can review the login history. When the project ends, remove the access or reduce the permissions to a minimum. It's a simple task almost nobody does, and it leaves stores with dozens of old accounts still active.

The principle of least privilege

The rule that works best is giving each person only what they need for their daily work. Someone in customer service doesn't need to install apps, and someone uploading products doesn't need to see financial reports. If someone needs something for a one-off task, grant it and remove it afterward.

This has nothing to do with distrust. The more people who can change the theme or install apps, the easier it is for a well-meant change to break something in production. And if a password leaks, the damage is limited to what that account could do.

Account security

Each person should have their own user and turn on two-step authentication. Shopify offers an authenticator app, security keys and passkeys, and new setups can't use SMS. The owner can't turn on two-step authentication for someone else, so you have to ask each team member to do it. On Shopify Plus, the organization can require a secure login method for all users.

Also keep in mind that to get paid through Shopify Payments, the account must have two-step authentication turned on; otherwise payouts can be held.

Onboarding, offboarding and regular reviews

Define a small process: who requests a new account, which role is assigned for each job and who approves it. When someone leaves the company, their account is deactivated or deleted the same day. Staff accounts can also be temporarily deactivated without deleting their history.

Every few months, review the list of users and collaborators. It's common to find accounts for people who no longer work with you, former agencies with full access or permissions granted for a one-off task that were never removed.