Reviewed October 10, 2026

How to set up Shopify staff accounts without giving away the keys

Staff permissions are how you delegate without risking your store. Which roles to create first, the permissions each one actually needs, and the mistakes that hand contractors too much access.

Why permissions deserve a plan, not a checkbox spree

Every staff account is a door into your store, and Shopify's permission checkboxes make it easy to open all of them at once. The default instinct is to grant everything so the person can "just get the work done." That works until a contractor's compromised laptop, a disgruntled freelancer, or a simple mistake meets full access to orders, customers, payouts, and settings. Least privilege is not paranoia; it is the difference between a bad day and a business-ending one.

The good news is that most roles need surprisingly little. A virtual assistant fulfilling orders needs orders and customers, not settings or apps. A designer needs themes and content, not payouts. Start from what the role actually does each day and grant exactly that, nothing more.

The roles to create first

For a typical small store, four roles cover almost everything. Order fulfillment gets orders, draft orders, and customers, so they can process and refund without touching the store's configuration. Content and design gets themes, pages, blog posts, and files, enough to update the storefront without access to financials. Marketing gets discounts, marketing, and analytics, so they can run campaigns and read results without installing apps or changing settings. And one trusted person, often the owner plus a second admin, holds full access as a backup.

App developers and agencies are the special case. They need theme and app-adjacent access temporarily, and Shopify's collaborator accounts exist for exactly this: time-limited access you grant and revoke per project. Never give a contractor a permanent staff account when a collaborator account does the job.

The permissions people get wrong

Settings access is the most over-granted permission. Almost nobody needs it day to day, yet it controls taxes, shipping, payments, and checkout, the financial plumbing of the store. Keep settings limited to owners. Similarly, the ability to install apps is effectively the ability to grant third parties access to your data, so treat app permissions as seriously as settings.

Customer data deserves its own caution. Anyone with customer access can export your entire customer list. That is necessary for fulfillment and support, but it means a departing contractor walks away with your list unless you revoke access promptly. Make deactivating accounts part of your offboarding checklist, not an afterthought you get to next week.

The setup routine that keeps you safe

Create roles before you need them, so adding someone is a two-minute task instead of a rushed checkbox session. Name roles by function, not by person, so they survive turnover. Turn on two-step authentication for every staff account; Shopify supports it and there is no reason to skip it. Review the staff list quarterly: deactivate anyone who no longer works with you, and check that nobody's permissions quietly expanded through role changes.

When someone leaves, deactivate immediately, then check for API credentials or private apps they may have created, which survive account deactivation. A clean offboarding takes five minutes and closes doors you forgot were open.

When something goes wrong

If you suspect an account is compromised, deactivate it first and investigate second. Change the store owner password and check the store's activity log for anything unusual: new apps installed, settings changed, exports downloaded. Shopify keeps an audit trail of staff actions, and it is the first place to look.

The uncomfortable truth is that most permission incidents are not hacks. They are mistakes by people who had more access than their job required. The fix is structural, not personal: narrow roles, prompt offboarding, and two-step authentication everywhere. Set it up once and it protects you quietly from then on.

Frequently asked questions

How many staff accounts should a small Shopify store have?

As few as possible: one per person who actually works in the store, each with only the permissions their role needs. Shared logins make it impossible to know who changed what, and over-permissioned accounts turn every team member into a security risk.

What permissions does a virtual assistant need?

Usually orders, products, and customers, but not settings, apps, or financial reports. Grant the minimum that lets them do their tasks, and review quarterly. It is easier to add a permission later than to recover from one that should never have been granted.

Should the store owner account be used daily?

No. The owner account has unlimited power and cannot be restricted, so use it only for ownership-level tasks. Create a separate staff account with broad but not total permissions for daily work. If the daily account is ever compromised, the damage is contained.