Reviewed October 18, 2026

Staff permissions in Shopify: roles that protect the store

One shared login and full access for everyone is how stores get hurt. Setting up staff accounts and permissions by job, plus the offboarding checklist that closes the loop.

The shared login problem

Many stores run on one owner login shared across staff, freelancers, and an agency from two years ago. Every action looks like the owner, nothing can be revoked individually, and when something goes wrong there is no audit trail, only a password to change and a list of people who might have it.

Individual staff accounts with scoped permissions fix all three problems at once: actions carry a name, access can match the job, and offboarding becomes removing one account instead of rotating a password the whole team uses by muscle memory.

Map permissions to jobs, not people

Define roles by function first: order fulfillment sees orders and inventory but not finances; customer support handles orders and customers but cannot edit the theme; marketing gets products, content, and discounts without payout access; developers get theme and app access without seeing full financial reports.

Then assign people to roles, including temporary ones. A freelancer building a landing page needs theme and content for a fortnight, not a permanent full account. Time boxed access, reviewed when the engagement ends, is the difference between a system and a hope.

The high risk permissions to guard

Payout and banking changes, staff management itself, theme code editing, and app installation deserve the shortest lists. Apps deserve special suspicion: an installed app inherits significant reach into store data, so app approval belongs with the owner or one trusted manager, never as a casual click by whoever hit the problem first.

Turn on every available sign in protection for accounts with these permissions, and keep the owner account itself for owner tasks rather than daily work, so its credentials stay rare, protected, and boring.

Offboarding, the step everyone skips

When someone leaves or an engagement ends, remove their account the same day, review which apps and integrations they installed or authorized, and rotate any shared secrets they could have seen. Check scheduled exports and connected tools too; access leaves through side doors more often than the front one.

Keep a simple access register: who has what, why, and when it was last reviewed. Ten lines in a document, updated quarterly, converts offboarding from archaeology into a checklist, and gives you an instant answer the day something looks wrong.

Frequently asked questions

How many staff accounts does Shopify allow?

Limits vary by plan, with higher tiers allowing more accounts and finer roles. Check your plan's current allowance in settings before designing roles, and consolidate by function if you are near the cap. The security logic in this guide applies at any count, including a team of three.

Should agencies get their own accounts?

Yes, individual accounts under the agency's own access request or collaborator arrangements where available, scoped to the work and removed when the engagement ends. Never hand over the owner login. An agency that insists on it is telling you something about their practices in every other area too.

What permissions does a fulfillment staffer actually need?

Orders, inventory visibility, and customer details for delivery questions cover most fulfillment work. They do not need finances, theme, apps, or staff management. Scoping tightly also reduces accidents: a fulfillment staffer cannot delete a product line they cannot see, which protects them as much as the store.

How often should permissions be reviewed?

Quarterly, and immediately at every departure or role change. The review is short when the register exists: read the list, ask whether each access still matches a current job, remove what does not. Permissions decay by default; only review keeps them true.