Reviewed November 2, 2026

Staff Permissions in Shopify: Which Roles Should Never Get Full Access

Create roles around jobs and give each the smallest permission set that lets the work happen. Fulfillment staff need orders and draft orders, not settings or themes. Marketing needs products, content, and discounts, not billing or staff management. Full organization and store ownership level access should sit with at most two named people. Turn on two step authentication for everyone, use individual accounts, never a shared login, and remove access the day someone leaves, in the offboarding checklist, not from memory.

The most common permission setup in small stores is no setup at all: everyone who helps with the store has full access, because granting it once was faster than thinking about roles. It works until it doesn't, and the failure menu is long: a well meaning contractor deletes the wrong collection, a seasonal helper's reused password gets phished, a departing employee retains a working login for months because nobody remembered it existed.

Permissions are an insurance policy you configure in an afternoon. The premium is a little friction. The payout is that entire categories of disaster become technically impossible rather than merely unlikely.

Map roles to jobs, not to people

Start from the work. Order fulfillment: orders, draft orders, customers for address questions, and nothing in themes, settings, or apps. Customer support: orders and customers, plus discounts if they issue goodwill codes. Marketing and content: products, collections, content, discounts, and analytics, with themes only if they actually edit them, which most do not. Finance: reports and billing views without store configuration rights. Developer or agency: themes and apps for the engagement's duration, with an end date set at the start.

Shopify's role system lets you build these once and assign them as people come and go. The discipline that matters is refusing the exception: the contractor who just needs full access for a day is the story that precedes most permission post mortems. Grant the specific missing permission instead; it takes two minutes longer and leaves an audit trail that makes sense.

The non negotiables

Two step authentication on every account, no exceptions for convenience, because a staff login is a key to customer data and payout settings. Individual accounts only: shared logins destroy accountability, and when something changes at 2 AM the question of who did it should have an answer. Ownership level access limited to one or two people, and those accounts get the strongest authentication the business owns.

Offboarding is where permission systems go to die. Put remove Shopify access on the same checklist as collecting keys and disabling email, and review the staff list quarterly against reality. Stores routinely discover, in that review, a login for someone who left last year and a test account from a developer nobody remembers hiring. Finding them in a calm quarterly review is the good outcome; the alternative discovery method is worse.

What to do about apps and API access

Apps request their own permission scopes, and the install screen is a permission decision most stores approve unread. Before installing, read what data the app wants and whether the job requires it; a shipping label app does not need your customer list's marketing status. Periodically review installed apps and remove the ones from finished experiments, because every installed app is standing access to store data held by a third party.

The same logic covers custom apps and API credentials created for integrations. Name them for their purpose, note the owner in your store document, and delete credentials when an integration is retired. Orphaned API keys are the quietest standing access in the whole system, and they never complain when you revoke them.

Frequently asked questions

How many people should have full access to a Shopify store?

As few as possible, typically one owner and at most one trusted second. Everyone else works through a role built for their job. Full access includes destructive powers, deleting products, changing payouts, removing staff, that most roles never need.

Should I give my developer or agency full access?

Give the permissions the engagement requires, usually themes and apps, through their own account or a collaborator account, and set a review or removal date at the start. Agency access that outlives the engagement by years is one of the most common findings in store security reviews.

What happens to a staff member's work when I remove their account?

Their historical activity stays in the store's timeline and order history. Removing the account removes the ability to log in; it does not erase records of what was done, which is exactly why individual accounts beat shared logins for accountability.

Does Shopify require two step authentication for staff?

Requirements vary by role and store setup, with sensitive roles pushed hardest, but treat it as mandatory in your own policy regardless. Most account takeovers trace to a phished or reused password, and two step authentication is the control that breaks that chain.