Shopify staff accounts and permissions: giving access safely
Never hand over your own login. Staff accounts, collaborator requests and least privilege take five minutes and remove a whole class of risk.
6 min read · Store setup ·
Every Shopify store eventually needs to give someone access — an employee, an agency, a freelance developer, a marketing contractor. The safe way takes five minutes and most stores don't do it, because sharing a password is faster in the moment and the cost only shows up later.
Never share the owner login
Two reasons, and the second is the one people underestimate.
Attribution. Shopify logs who did what. That log is only useful if each person has their own account. With a shared login, "who changed the price on Tuesday" has no answer.
Revocation. Removing a shared login means changing a password everyone uses, and telling everyone the new one. Removing a staff account is one click, and nobody else is affected.
A developer who asks for your personal credentials is telling you something about how they work — it's on the list of red flags for a reason.
Staff accounts vs collaborator accounts
Staff accounts are for people who work for you. They count against your plan's staff limit and you create them.
Collaborator accounts are for agencies and freelancers working through a Shopify Partner account. They request access, you approve it, and they don't consume a staff seat. This is the normal route for a developer, and it's better for you: the access is clearly external, and revoking it doesn't touch your team.
If a developer can request collaborator access and asks for a staff account instead, ask why. Usually there's no reason beyond habit.
Least privilege, concretely
Grant what the job needs and nothing else.
| Role | Typically needs | Should not have |
|---|---|---|
| Developer | Themes, apps, products, orders (view) | Payouts, customer exports, plan settings |
| Marketing | Products, discounts, content, analytics | Orders, finance, apps |
| Customer support | Orders, customers, draft orders | Themes, apps, settings |
| Warehouse | Orders, fulfilment, inventory | Everything else |
The two permissions to be most careful with are customer data export and finances. The first is a privacy exposure, the second is a fraud one. Neither is needed to build a theme.
The things that get forgotten
- Apps have permissions too. An app you installed three years ago may still hold broad access to orders and customers. Audit installed apps periodically — you'll usually be removing several anyway.
- Third-party systems need scoped credentials. An ERP or accounting connector should have its own API credentials with the narrowest scope that works, not an admin login sent over email — see ERP integration.
- Two-factor authentication on the owner account, at minimum. Ideally on everything.
Offboarding
The step nobody does. When a person or an agency finishes:
- Remove the staff account or revoke the collaborator access.
- Rotate any API credentials that were shared with them.
- Check for apps they installed that nobody now owns.
- Confirm you actually have the code and the documentation — this is the moment you find out, and it's much easier to fix while they're still answering emails. Hiring remotely covers what handover should include.
Set a recurring reminder to review the access list twice a year. Old accounts accumulate silently, and an ex-contractor's active admin login is exactly the kind of thing that's discovered during an incident rather than before one.
Access control is boring and takes five minutes. Sharing a password is exciting and takes thirty seconds. Choose accordingly.
Is this the problem you’re looking at?
Send me the link to your store and a line about what is going wrong. You get a straight answer within one business day — no pitch, no obligation.
mario@clicksandcarts.coOr see what I do around Shopify: services, work beyond the theme, selected work.