In this guide · 7 sections
Short answer
Give each person their own Shopify login with a role that covers only their job (for example Merchandiser or Customer support), require two-step authentication, use collaborator accounts for agencies, and suspend or remove users the day they leave. Staff accounts need the Grow plan or higher.
How many staff accounts each Shopify plan allows
Shopify's user limits page sets the number of staff accounts by plan. The store owner does not count towards the limit.
| Plan | Staff user accounts | Not counted in the limit |
|---|---|---|
| Starter | 0 | Store owner, collaborators, POS-only staff |
| Basic | 0 | Store owner, collaborators, POS-only staff |
| Grow | 5 | Store owner, collaborators, POS-only staff |
| Advanced | 15 | Store owner, collaborators, POS-only staff |
| Shopify Plus | Unlimited | Not applicable |
If you downgrade to a plan with a lower limit, Shopify suspends users over the limit, starting with pending invites and then the users inactive for longest.
Roles: give each person only what they need
A role is a bundle of permissions for a job. You manage them under Settings > Users > Roles, and a user with several roles gets all their permissions combined. Shopify's predefined roles are a good starting point; you can edit or delete them.
| Typical staff member | Starting role | What to leave out |
|---|---|---|
| Product and stock updates | Merchandiser (Products, Catalogs, Content) | Orders, customers, settings |
| Order and customer questions | Customer support (Orders, Draft orders and more) | Settings, apps, finances |
| Ads and promotions | Marketer (Marketing, Customers) | Orders, settings, payouts |
| Theme and page edits | Online store editor | Customer data, orders |
| Shop floor sales | POS role such as Cashier or Sales associate | Shopify admin access |
Two points matter most. Only the store owner and users with the Administrator role can manage roles on a single store, so keep Administrator to one trusted person besides the owner. And anything touching payouts, billing or bank details should stay with the owner.
Collaborator accounts for agencies and developers
Developers and agencies who are Shopify Partners should use collaborator accounts, not a staff login. They do not use up your staff limit and are easier to control.
Share your collaborator request code
Find it under Settings > Users > Security. Only partners who have your code can request access. Generating a new code makes old codes stop working.
Review the request
Shopify shows partner details such as when the account was created and the country the request came from, flagging a possible VPN. Confirm with the partner if anything is unexpected.
Trim the permissions
Each request comes with an auto-generated role based on what the partner asked for. Remove anything they do not need before you accept.
Accept and note the end date
Collaborators cannot be given the Administrator role on a single store, cannot use POS, and cannot become the store owner. Access expires after 90 days without a login.
Our guide to choosing a Shopify developer in Singapore covers what to agree before granting access.
Two-step authentication and POS PINs
Shopify's two-step authentication settings let you require a secure sign-in method for each user. Open Settings > Users, click the user, and set Secure sign-in method is required. Changing it to required logs that user out, so do it when they are not mid-task.
- Two-step authentication is tied to the person's Shopify ID, not to your store. You cannot see or reset their phone number or app; they recover it through Shopify's account recovery.
- Removing a staff member and re-inviting the same email does not reset their two-step setup.
- On the shop floor, every staff member with POS access gets a unique PIN. Assign each person only the locations they work at and a POS role suited to their job, with manager approval for refunds where needed.
- Never share PINs, and change a PIN if someone else learns it.
When staff leave or a store changes hands
Leavers are where most Shopify access problems start. Act on the last working day.
Shopify leaver checklist
To change the store owner to someone already on the store, the current owner uses Settings > Users. To transfer to someone outside the store, Shopify points to Settings > General. Only the owner can do either, and a store using Shopify Capital or Shopify Credit cannot be transferred. Our guide to a Shopify store hacked through a staff account covers what to do if a login has already been misused.
Do it yourself or get help?
For a store with a handful of staff, setting up roles and two-step login takes an hour. The harder part is keeping it tidy as people come and go, and making sure the email accounts behind each Shopify login are protected too.
Our Shopify Store (S$1,890) builds a branded store with payments, shipping and policies set up. Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA on the email accounts your staff use to log in, cleans up admin roles and adds a leaver checklist. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
No. Shopify's user limits page lists 0 staff accounts on the Basic and Starter plans, 5 on Grow, 15 on Advanced and unlimited on Shopify Plus. Collaborator accounts for Shopify Partners and POS-only staff do not count towards the limit, so outside developers can still work on a Basic store.
Staff accounts are for your own team and count towards your plan's limit. Collaborator accounts are for Shopify Partners such as agencies and developers. They need your request code, do not count towards the limit, cannot use POS, cannot be the store owner, and expire after 90 days without a login.
Yes, per user. In Settings > Users, open each user and set the secure sign-in method to required. The setting applies to that person regardless of role. Shopify recommends it by default for new users. Each person manages their own authentication app or phone on their Shopify ID.
Go to Settings > Users, click the person, then Actions and Suspend, or Remove to delete them permanently. Also revoke any devices still signed in, remove their POS PIN and locations, and change any shared passwords for connected services they knew.
Not to a collaborator account. Shopify says you cannot transfer store or organisation ownership to a collaborator. Ownership can be changed to an existing staff user, or transferred to someone outside the store, and only the current owner can do it. Keep ownership with the business, not an outside developer.