If you run your Shopify store with more than one person, granting permissions to staff and outside partners is unavoidable. That said, many people struggle with questions like "who should get which permissions?" or "I'm not sure how to set this up." Getting permissions wrong can lead to unintended actions or the risk of information leaks.
This article covers everything from the full list of Shopify permission types, to the steps for adding staff and collaborators, to how to think about permission design for different operational scenarios.
※ This content is based on information as of March 2026.
When Do You Need to Grant Permissions on Shopify?
You don't need to think about Shopify's permission settings while you're running your store alone. But as your store grows and more people get involved, permission management becomes essential.
Here are three common situations where granting permissions becomes necessary.
When Dividing Work Among In-House Staff
Once your store operations get going, work naturally gets divided — Staff A handles product listings, Staff B handles order processing, and so on. If everyone has access to every admin screen, that creates a risk of mistakes or mishandling of information.
For example, a staff member who only handles product listings doesn't need permissions for "Finance" or "Store settings." On Shopify, you can create "roles" tailored to specific job functions and assign them to staff, enabling appropriate access control.
When Outsourcing Work to an External Agency or Operations Partner
When you outsource design changes or app setup for your ecommerce site to an external agency, they also need access to your store.
In this case, rather than a staff account, you use "Collaborator" access — a mechanism designed specifically for external partners. Collaborators don't count toward your staff limit, making them well suited for working with outside parties.
When Transferring Ownership of a Store
Permission settings also come into play when an agency builds a Shopify store and hands it off to the operator. The typical flow is to add the client as staff, grant the necessary permissions, and then transfer owner access before handoff.
※ If you're doing delivery work as a Shopify Partner (an agency or freelancer), using the Collaborator feature for the handoff is also an option.
Shopify Has Three Types of Permissions
Shopify account permissions break down broadly into three types: "Store owner," "Staff," and "Collaborator." Let's go over the role and characteristics of each.
Store Owner — The Top-Level Permission That Controls Everything
The store owner is the top administrator of a Shopify store. They can change plans, manage payment information, add or remove staff — every operation is available to them.
Only one owner can be set per store. Since many operations are exclusive to the owner, owner account management deserves special care.
Staff — Access Controlled Through "Roles"
Staff are internal accounts added by the store owner. Previously, Shopify granted permissions by checking individual boxes directly for each staff member.
With a 2025 update, a "role-based access control model" was introduced, and permissions are now managed by first creating "roles," then assigning those roles to staff. Since roles can be reused, permission mistakes and gaps become less likely to occur, even as your staff grows.
For example, if you create a "Merchandiser" role and bundle together permissions related to products, catalog, and content, you can grant appropriate permissions to a product-focused staff member just by assigning them that role.
The number of staff you can add is capped depending on your plan.
Collaborator — Access Exclusively for External Partners
Collaborator is the mechanism through which Shopify Partners (agencies, freelancers, etc.) access a store. The major difference from staff is that access is granted when the owner approves a request coming in from outside.
Collaborators don't count toward your staff limit, and can be added without limit on any plan. Note that if there's no login to the store for 90 days, access expires automatically.
The table below compares the three types.
| Item | Store Owner | Staff | Collaborator |
|---|---|---|---|
| Primary use | Store's top administrator | In-house operations team | External design/operations partner |
| Permission scope | Every operation is available | Granted through a role | Granted through a role |
| How they're added | Set automatically when the store is created | Invited by the owner | Requested by the partner → approved by the owner |
| Number limit | Only 1 | Varies by plan | Unlimited |
| POS use | Available | Available | Not available |
Full List of Shopify Store Permissions and How to Read It
When granting permissions to staff or collaborators, you need to understand what each permission item shown in the Shopify admin actually means. Here we'll organize the main permission categories and their content into a list.
Full List of Store Permission Categories
Shopify's store permissions are broken into categories based on each feature in the admin. As of March 2026, there are 19 configurable permission categories.
| Category | What it mainly allows |
|---|---|
| Home | View the store's dashboard |
| Orders | View, edit, fulfill, and refund orders |
| Drafts | Create, edit, and delete draft orders |
| Products | Add, edit, and delete products; manage inventory |
| Gift cards | Issue and manage gift cards |
| Customers | View and edit customer information; manage segments |
| Marketing | Create and manage marketing campaigns |
| Discounts | Create and manage coupons and discount codes |
| Content | Manage files and metaobjects |
| Markets | Configure markets (countries and regions) |
| Catalog | Manage catalogs |
| Checkout and customer accounts | Configure the checkout screen and customer accounts |
| Users | Add and remove staff; edit permissions |
| Finances | View financial information — sales data, payment information, invoices, etc. |
| Store analytics | View analytics reports such as sales and traffic |
| Online Store | Edit themes and configure blog posts and pages |
| App development | Create and manage custom apps |
| Store settings | Change store-wide settings — shipping, payments, taxes, notifications, etc. |
| Company (Shopify Plus plan only) | Manage companies and assign users |
Each category also contains more granular permission items. For example, the "Products" category includes permissions related to inventory, so it's further subdivided by feature. There are also dependency relationships — for example, setting inventory or catalog permissions automatically grants the "view" permission for products.
On top of that, each item also has action-level settings such as "view," "create and edit," and "delete," making fairly fine-grained access control possible.
You don't need to grant every permission — the basic approach is to select only the categories a staff member's job actually requires.
Highly Sensitive Permissions
On Shopify, access to "information that requires careful handling" is treated as a "highly sensitive permission." Specifically, this covers "Customers," "Finances," "Users," and "Companies" (Shopify Plus plan only).
Image source: Shopify
A confirmation message is shown when granting a highly sensitive permission to staff, so consider carefully whether it's necessary before setting it.
Watch Out for Permission Dependencies
Shopify's permissions have "dependencies." Selecting a given permission automatically selects another permission required for it to work.
For example, selecting a permission related to inventory management or the catalog automatically turns on the "view" permission for products. If you want to configure permissions in fine detail, keep this dependency behavior in mind as you work.
Steps for Granting Permissions to Staff
From here, we'll walk through the concrete steps for adding a staff account to a Shopify store and granting permissions.
[Admin] Adding Staff
Staff are added by an account that has the "add users" permission. In the Shopify admin, click "Settings" at the bottom of the left-hand menu. Select "Users and permissions" from the menu, then click "Add staff" in the Staff section.
In the "User details" section, select "Admin user" or "POS user." Enter the email address of the staff member you're adding, and click "Add."
In the "Roles" section, set the permissions the user needs based on their role. You can assign multiple roles.
Common built-in roles you can set include:
- Administrator
- POS admin
- Online store editor
- Customer support
- Merchandiser
- Marketing manager, and more
You can also create new roles. On the Plus plan, you can group users together to manage permissions collectively (e.g., a North America customer support group).
Click "Send invite" at the bottom of the screen, and an invitation email will be sent.
[Staff] Creating a Staff Account
The invited staff member will receive a notification by email. Clicking the link in the email lets them create a new Shopify account or log in, giving them access to the store as staff.
Note that the invite link expires after 7 days. If it expires, you'll need to remove that user from the admin once, then add the user again and resend the invite.
Staff Limits by Plan
The number of staff you can add varies depending on your Shopify pricing plan.
| Plan | Staff you can add |
|---|---|
| Basic / Starter | Not available |
| Grow | 5 |
| Advanced | 15 |
| Shopify Plus | Unlimited |
The Basic and Starter plans don't allow you to add staff, so if you're running your store with multiple people, you'll need to upgrade to Grow or higher. Note that collaborators can be added regardless of plan, so if you're working with an external partner, the Basic plan can still work.
Steps for Granting Permissions to Collaborators
When co-managing a store with an outside agency or freelancer, you use the collaborator mechanism. Unlike staff, adding a collaborator starts with a request from the partner's side.
For more on collaborators, also see the blog article below.
[Partner] Requesting Access
Before requesting access, check the store's "request code" with the store owner. The request code can be found in the Collaborators section under Settings > Users and permissions.
The partner logs into the Shopify Partner dashboard. Under "Stores," click "Add store" > "Request access to a collaborator store," in that order.
Enter the URL of the store you want to access and the request code. Select the permissions you need and submit the request.
[Store Owner] Approving the Request
A request notification will appear on the Shopify admin's home screen. Review the request and approve it.
The owner can review the permissions the partner has requested and either approve them as-is, or adjust them before approving. Make sure to grant collaborators only the permissions their work actually requires.
How to Edit, Remove, or Suspend Permissions on Shopify
Granting a permission isn't a one-time task — it's important to revisit it as job responsibilities change or staff move to different roles.
Steps for Changing Staff Permissions
To change a staff member's permissions, go to Settings > Users and permissions in the admin, click the staff member's name, and add or remove roles in the "Roles and groups" section.
For example, if a staff member who used to handle only product listings now also takes on order processing, you can assign an additional role that includes order management permissions.
If you want to change the permissions contained within a role itself, you can edit that role from Settings > Users > Roles. Note that doing so applies the change to every staff member assigned that role.
The Difference Between Removing and Suspending Staff
There are two ways to stop a staff member's access: "remove" and "suspend."
"Remove" permanently revokes the account, and that staff member can no longer access the store. Use this when a staff member leaves the company, for example. "Suspend," on the other hand, temporarily halts access while keeping the account intact. This is suited to situations like parental leave or an extended leave of absence, where the person may return in the future.
Both actions can be performed from Settings > Users and permissions by selecting the target staff member.
Points for Designing Permissions to Operate Safely
Once you understand the steps for setting permissions, it's worth taking one more step and thinking through the operational question of "how should you design permissions?"
Default to the "Minimum Necessary Permissions"
The basic principle of granting permissions is to "assign a role that includes only the minimum permissions the job requires." It's easy to just assign a role with full permissions, but that raises the risk of mistakes or information leaks.
Permissions related to financial information or store settings in particular have a large impact, so make sure to include them only in the roles of staff who genuinely need them.
Use Both Predefined Roles and Custom Roles
Shopify comes with "predefined roles" set up in advance. For example, the "Merchandiser" role bundles together access to Home along with permissions related to products, catalog, and content.
It's a good idea to first check whether a predefined role fits your store's operations, and create a custom role if it doesn't. By reusing roles, you can assign the same role to new staff members as they join, making permission mistakes and gaps less likely.
Make Use of Two-Factor Authentication
Shopify recommends setting up two-factor authentication for staff accounts. Enabling two-factor authentication requires entering a verification code in addition to a password at login, which substantially reduces the risk of unauthorized access.
Be sure to set this up alongside your permission configuration.
Manage Permissions Properly to Run Your Store Safely and Efficiently
Permission management isn't something you set up once and forget — it's important to revisit it periodically as staff roles change and people move between positions. Start by checking whether any staff currently have permissions your store no longer needs them to have.
