How to Give Shopify Access as a Store Owner?

As a Shopify store owner, you’ll sometimes need help from professionals like developers, designers, freelancers, or agencies  to keep things running. But you may feel insecure about giving someone access to your store that you barely know. 

The good news is, there are some ways to go about it in a safe manner. Today, we’ll walk you through how to give Shopify access without putting your business at risk.

What Types of Access Does Shopify Offer?

You probably already know Shopify has mainly two types of access:

• Staff accounts: these are for your employees that count toward your staff limit (depending on the plan).
  
• Collaborator accounts: these are for external parties like freelancers or VA agencies, but they do not count toward staff limits.

Also, for development or app-dashboard work, there are more specific roles like “Apps Developer” and custom permissions for you to control what can and cannot do with their access.

How to Give Shopify Access to Others as a Store Owner

Here’s a step-by-step to give someone access, without handing over more than what’s needed:

Step 1: Decide Exactly What Needs to be Done

Take your time to list down the tasks you are asking the person to do. They may include editing theme code, fixing layout or design, adding or editing products, setting up apps or integrations, and many more.

This is an important step because it will help determine what kind of access you will give and avoid risks further down the line. 

Step 2: Choose Access Options 

As you already know, if the person is part of your in-house team, assign staff permissions. But if they are external, such as a virtual assistant that’s not on your payroll, you should use a collaborator account with the Shopify Partner program.

Step 3: Enable and Share a Collaborator Request Code 

Shopify facilitates a collaborator request code to block unauthorized requests and help protect your store. Only those who have this code are allowed to send requests for collaborator access.. 

Here’s how to use it:

1. Go to Settings > Users & Permissions in your Shopify admin.
   
2. Under Collaborators, turn on “Only people with a collaborator request code can send a collaborator request.”
   
3. Now click “Generate new code.” Copy it and send it to the person you’re giving access to.

Step 4: Receive & Review the Collaborator or Staff Request

If you have hired a developer, they (if collaborator) will request access through their Partner Dashboard using the code. They will also specify which permissions they want. You will get a notification in Shopify admin about the request.

Step 5: Assign Your Permissions Carefully

When you’re reviewing a request, don’t forget about these things comparing the requested permissions with what you have defined in Step 1. If something is extra and you don’t need it, just deny or remove those permissions.

For example, if someone needs to just edit the theme, they do not need access to orders, customers, billing, or financial reports. So, you can use the “role” or “custom permissions” feature to define which parts of the Shopify admin the person can access.

Step 6: Approve Access

If everything looks good, feel free to accept their request. For your staff, send an invite and wait for them to accept. 

And for collaborators, accept the collaborator request.

Step 7: Monitor Their Work & Activities

After granting access, keep an eye on what the person is doing. Since Shopify logs actions like changes to themes or app installations, it’s easy to track.

What’s more, you can consider having them send you backups or having version control for the theme or code so you can fix it if something goes wrong. 

However, if it involves a larger work, you can ask them to work first in a development store or a staging theme to preview changes before going live. But remember that this is not always possible, but a safer option anyway.

Step 8: Remove Access When Done

Once the task is complete, revoke any permissions or collaborator/staff account that you no longer need immediately. But if you think you may need help from the professional in the near future, you can leave a minimal set of permissions. But keep them limited.

The good news is, Shopify also auto-expires collaborator accounts if they haven’t logged in for 90 days. 

Security Tips from Our Pros

Over the years, we’ve worked with many Shopify stores and learned a few ways to make it safer. Take a look at them: 

1. Code Review or Pull Request Style Delivery

If possible, ask the developer to deliver theme changes via version control (e.g. Git). Also, even if the work is small, maintain diffs because you can review the diff (which files changed, what code additions/edits) before you go live. This will help avoid surprises.

2. Staging/Duplicate Theme Workflow

Maintain a duplicate or staging theme. All changes in the layout, design, or code happen in that version. Once approved, you can publish it. This will give you rollback if something breaks.

3. Use Backup Apps or Tools

This is extremely important. Before granting access (especially for theme or app installs), make a backup of your theme and store settings. 

Remember, Shopify doesn’t automatically back everything up. So, you’ve to use apps that’ll snapshot your theme or store configuration.

4. Apply the Least-Privilege Principle

As said before, always grant the minimum permissions required. If they just need to update images or edit CSS, there’s no need to give access to orders, customers, or billing.
Also, keep track of expiry for time-bounded tasks. Either set a calendar reminder for yourself to remove access or do it immediately after the job is done.

5. Use Two-Factor Authentication) for All Key Accounts

For your own admin and for any staff or collaborator that can request elevated permissions, make sure they have 2FA. Some Shopify roles require it, which safeguards against any kind of credential theft.

6. Vet the Professional with Care

If you’re hiring, for example, a freelance developer, get references and check their reviews carefully. You may have good security practices, but a dishonest person could cause damage if they have access. That’s why at Bidbat, we source only highly reputed and passionate Shopify experts to keep our clients worry-free.

7. Define Written Scope & Contract

Before you start, agree in writing essential factors like: what will be done, the timeline, deliverables, permissions needed, what will happen if something goes wrong, and more. This is necessary because both you and the developer should share expectations.

8. Monitor Recurring costs or Credentials

If you’ve hired a Shopify assistant before, you know that installing apps or integrations could incur recurring costs or require sensitive credentials in some cases. Double check what’s being added.

9. Audit Access Regularly

This is another crucial step. To stay on the safe side, audit all staff and collaborators every few months. Check who still needs access and remove those who don’t. Shopify’s interface lets you list users/collaborators and their roles.

10. Have a Recovery Plan

If something goes horribly wrong caused by a theme bug, malicious code, or unwanted app, what will you do? You should have a recovery plan to save your store and your business. Every store manager should also know how to contact Shopify’s support team.

Common Mistakes to Avoid

No matter how careful you are, you can make mistakes when giving your Shopify store’s access to someone else. Keep these factors in mind and you’ll be fine:

• Granting “just because;” e.g. just because you trust someone, you give full permissions even if they don’t need them.
  
• Forgetting to revoke access when the task is completed.
  
• Not checking what a collaborator request is really asking for – sometimes they request more than they need.
  
• Not backing up before any big changes.
  
• Using weak passwords or skipping the 2FA code.
  
• Forgetting that apps/integrations themselves may have their own data access – so even if Shopify permissions are tight, a bad app could leak or modify data.
  

Wrapping It Up

Now that you know how to give Shopify access to an ecommerce virtual assistant or others, it’s time to be stress-free and get back to work. Careful planning, minimal permissions, backups, and good vetting will allow you to safely bring in outside help to upgrade your store, fix bugs, or build new features without having to put your business at risk.

So, if you follow our recommended steps, you’ll not only protect your store, but you’ll also work more efficiently with less stress and fewer emergency calls at 3 am.