Giving holiday help access: a guide to Shopify staff accounts and permissions

Shopify staff accounts give each person who helps run your store their own login, with only the permissions their job needs. If you are bringing on seasonal packers, a freelance marketer or an agency developer before the holiday rush, the safe setup is the same every time: one login per person, a role that limits what they can see, two-step authentication, and a clear date when access ends.

Shopify's admin now calls staff accounts "users", and access is built from roles. Many older guides still describe the previous setup and plan limits. This guide follows Shopify's current documentation, so you can check your plan's limit, build a seasonal role, invite people, let partners in safely and remove access cleanly in January.

Staff, collaborator or POS user: pick the right account first

Shopify has three kinds of access, and they count differently against your plan.

• Admin users (staff). Employees and contractors who work in your Shopify admin: order processing, customer service, product updates, discounts. They count toward your plan's user limit.
• Collaborators. Agencies, developers and other Shopify partners who request access from their own partner account. Collaborators don't count toward your store's user limit.
• Point of Sale users. Retail staff who only log in to Shopify POS at a POS Pro location. They don't get access to your Shopify admin, don't need an email address and aren't counted in the limit.

A simple rule: if the person works for your business, give them a staff login. If they work for a partner business, ask them to request collaborator access instead of sharing a staff seat.

Check how many staff accounts your plan allows

This is where many guides are out of date. According to Shopify's user plan requirements, the maximum number of user accounts is:

• Starter: 0 users
• Basic: 0 users
• Grow: 5 users
• Advanced: 15 users
• Shopify Plus: unlimited users

The store owner, collaborators and POS-only staff sit outside that total. So on Basic you can still work with an agency through a collaborator account, but you can't add employees with their own admin logins. If you need more seats for the season, plan the upgrade before you start inviting people, not on the morning of Black Friday.

Build a seasonal role before you invite anyone

Roles are the cleanest way to keep holiday access tight. A role is a named set of permissions you assign to one or more people, and custom store roles are available on every plan except Basic and Starter. Shopify's guide to managing roles describes the steps:

1. In your Shopify admin, go to Settings and then Users.
2. Open Roles and click Add role.
3. Select a role category, then give the role a name and a short description, for example "Holiday fulfillment: orders only".
4. Select the permissions the role needs, and any app permissions.
5. Click Save.

Two details are worth knowing. First, if someone has several roles, they get the combined permissions of all of them, so stacking a broad role on top of a narrow one removes the limit you wanted. Second, roles managed by Shopify, such as Administrator, can't be edited or deleted. On stores not on Shopify Plus, Administrator is described by Shopify as a high-trust role with permissions for almost all features, so keep it for the people you would trust with the whole store.

Start from the tasks, not the menu. Someone packing orders needs order and fulfillment access, not discounts, themes or apps. A customer service hire may need customers and orders, but probably not the ability to export customer profiles, which is a separate Customers permission. Shopify flags certain sensitive permissions, including Request data under Customers, and Edit billing payment methods and pay invoices and Manage other payment settings under Finance. Keep those for your most trusted people.

Invite the person and confirm they accept

With the role ready, adding someone takes a minute:

1. Go to Settings and then Users, and click Add users.
2. Under User details, keep Admin user selected.
3. Enter their work email address and click Add.
4. Leave Secure sign-in method turned on. It's on by default.
5. Under Roles, click Assign and choose your seasonal role.
6. Review the permission summary, then click Save.

Invitations expire after 7 days. Until the person accepts, they show as Pending in your users list. If an invite lapses, remove the pending user and invite them again. Send invites a week or two before the person starts, so you have time to chase anyone who hasn't accepted.

Let agencies and developers in as collaborators

Agencies and developers should never share a staff login or use yours. Shopify's collaborator accounts are built for this:

• Give the partner your 4-digit collaborator request code. You'll find it under Settings, Users (or Users & permissions), then Security.
• Their request appears in your users list under the Requests filter, where you can accept or reject it.
• Collaborators can't log in without two-step authentication turned on for their own account.
• If a collaborator doesn't log in for 90 days, their access expires. You can reactivate it from their user page.
• Once a project is done, remove or suspend the collaborator from their user page, then click Generate new code so the old code stops working for new requests.

Turn on the security checks that catch mistakes

Two-step authentication is set up by each person on their own account. The store owner can't activate it for someone else, which is why leaving the Secure sign-in method toggle on at invite time matters. Ask every new user to confirm they've set it up on their first day.

Then get to know the store activity log. Go to Settings, then General, and under Resources click Store activity log. It shows recent actions with the name of the person, app or channel that took them, such as deleting a product or changing a store setting. Shopify's activity log documentation explains that owners and administrator roles see a newer version with filters, where entries are kept for 18 months from when that log started tracking them. Entries can't be exported, so check it during the season rather than months later.

A worked example: three holiday hires on the Grow plan

Say you sell candles on the Grow plan, with five user seats. Your operations lead already has a staff login, and as the owner you don't count, so four seats are free. For the season you're adding two packers, one freelance customer service agent and an agency that is building a gift guide page.

• Before: everyone gets Administrator because it's quick, the agency is given a staff seat, and nobody writes down who has access. In January, four people still have full access to orders, customers and settings.
• After: the two packers share a "Holiday fulfillment" role with order and fulfillment permissions only. The customer service agent gets a "Holiday support" role with orders and customers, but no customer export. The agency requests collaborator access with your code, so it uses no seat. You note an end date for each person.

In this example you use three of four free seats, and no new user can change payment settings or install apps.

Offboard seasonal staff in January

Access that outlives the job is an easy gap to miss. Shopify's manage users page gives you two options, both found by clicking the person's name in Settings and then Users and opening Actions:

• Suspend. The person can no longer log in, and you can reactivate them later. Good for someone who comes back every season.
• Remove. The person is removed permanently, and you can't undo it. Good for one-off contractors.
• Collaborators. Remove agency or developer access the same way once their project ends. A new request code alone doesn't remove anyone who already has access.

From the same user page you can also revoke access for a specific device or application, which helps when someone leaves a shared packing-station computer signed in.

A quick staff access checklist

• Confirm your plan's user limit and upgrade first if you need more seats.
• Create a custom role for each seasonal job, with only the permissions it needs.
• Keep Administrator and sensitive permissions for a small trusted group.
• Invite people early and check that no invite is still Pending.
• Leave Secure sign-in method on and confirm two-step authentication is set up.
• Bring agencies in as collaborators, then remove them and generate a new request code when they finish.
• Check the store activity log weekly during the season.
• Put a suspend or remove date in your calendar for every seasonal user.

Common mistakes and what this won't fix

• Sharing the owner login. Some actions only the store owner can take, including managing Shopify Payments, deactivating the store and transferring ownership. Sharing that login hands all of this to someone else and leaves the activity log unable to show who did what.
• Giving everyone a broad role. Because roles combine, one wide role cancels out every narrow one.
• Forgetting third-party tools. Shopify roles control access to your Shopify admin. Logins your team uses for email, shipping or other outside services are managed in those tools, so offboard people there too.
• Treating permissions as a substitute for training. A tight role stops someone changing settings, but it won't stop a packer shipping the wrong item. Pair access with a short written process for the job, such as how you handle high-risk orders or phone and gift orders through draft orders.

Common questions

Can I add staff accounts on the Shopify Basic plan?

No. Shopify's plan requirements list Basic and Starter with 0 users. You can still work with agencies and developers through collaborator accounts, which don't count toward the limit.

Do collaborator accounts count toward my staff limit?

No. Collaborators sit outside your plan's user limit. They need your request code to ask for access and must use two-step authentication to log in.

What's the difference between suspending and removing a user?

Suspending stops the person logging in and can be reversed. Removing is permanent and can't be undone, so you'd need to invite them again to restore access.

Can I see what a staff member changed in my store?

Yes. The store activity log under Settings, then General, shows recent actions with the name of the person, app or channel that took them. If a dispute comes up after the season, it helps alongside the evidence covered in our guide to responding to Shopify chargebacks.

Next step

Open Settings, then Users, and check two things today: how many seats your plan has left, and whether anyone from last season still has access. Then create one seasonal role and invite your first holiday hire.

Install Atomato free on Shopify