Reviewed October 24, 2026
Shopify Staff Accounts and Permissions: A Setup Guide That Prevents Lockouts
Who can refund, edit the theme, and see customer data should be a decision, not a default. How to set staff roles, protect the owner account, and offboard cleanly.
Permissions are a business control
Every staff account is a set of keys: to refunds, to customer data, to the theme code, to the bank details page. Stores usually hand out broad access because it is faster than thinking, and discover the cost during an incident: a mistaken bulk edit, a compromised account with full rights, or a departed contractor who still has the keys months later.
Setting permissions deliberately at setup, when the team is small and the decisions are easy, prevents the much harder project of clawing access back later. The principle is least privilege: each person gets the access their actual work requires, and nothing rides along just in case.
Roles matched to real jobs
Map roles to work, not to seniority. Support staff need orders and customers, not theme code or finance. A developer needs theme and app access for the engagement, ideally time boxed, and does not need to export the customer list. Marketing needs products, content, and discounts, not payout settings. Writing that map down, even in one page, turns every new invite into a lookup instead of a debate.
Review the two or three most dangerous permissions separately: changing bank and payout details, exporting customer data, and deleting products or the store. Very few accounts should hold any of them, and the store should be able to name, from memory, exactly who holds each.
Protect the owner account like a vault door
The owner account can do everything, including transferring ownership, so it deserves the strongest treatment on the store: a unique password in a password manager, two factor authentication, and an email address that is itself secured and monitored. It should not be the daily working account for anyone, including the owner.
Daily work happens in named individual accounts, never a shared login. Shared credentials destroy accountability, make offboarding impossible without disrupting everyone, and mean a single phished password hands over the store with no way to tell whose session did what. Individual accounts cost nothing and buy a complete audit trail.
Offboarding as a checklist, not a memory
When someone leaves or an engagement ends, access removal should happen the same day, from a written list: staff account, apps they administered, shared tools connected to the store, and any API keys or private apps they created. Keys and integrations are the part everyone forgets, and they survive cheerfully after the visible account is gone.
Run a quarterly access review: print the staff list, confirm every name is current, confirm every permission still matches a job, and remove what does not. Fifteen minutes a quarter keeps the map true, and it is far easier than reconstructing who had access after something goes wrong.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: Shopify Tax Setup: A Plain Checklist for New Stores, Shopify Shipping Zones and Rates Explained Simply, and Setting up Shopify email hosting and forwarding for your store domain.
Frequently asked questions
How many staff accounts can a Shopify store have?
Limits depend on the plan, and roles based accounts make the count manageable. What matters more than the number is that every account is a named individual with permissions matched to their job, rather than shared logins with broad access.
Should my developer have full access?
A developer needs theme, app, and sometimes product access to do the work, but rarely needs finance, payouts, or customer exports. Grant what the engagement requires, note when it should be reviewed, and remove or reduce it when the project ends.
What is the most important account to secure?
The store owner account, because it can transfer ownership and change anything. Give it a unique managed password, two factor authentication, and a secured email, and use a separate named account for daily work, even if you are the owner.
How often should I review staff access?
Quarterly is a practical rhythm, plus immediately whenever someone leaves or a contractor engagement ends. The review is simple: every account belongs to a current person, and every permission still matches a current job.