Getting agency staff into a client's Shopify or BigCommerce store

Shopify and BigCommerce both let the store owner bring in your staff without handing over the owner’s login. For a client selling on Amazon instead, see Amazon Seller Central user permissions. The general idea is in what is delegated access?.

Who can sign in to a Shopify store

A Shopify admin has three kinds of people: the store owner, staff, and collaborators. Staff are invited by email from Settings > Users and given one or more roles. Shopify Help describes a role as the permissions one job needs. A person with two roles gets the permissions of both added together. Invitations expire after 7 days, and a lapsed one means removing the person and adding them again.

Collaborators are Shopify Partners (businesses in Shopify’s partner program) that the owner has let into the store.

The plan sets how many staff a store can have. Shopify’s plan table lists 0 users on Starter and Basic, 5 on Grow, 15 on Advanced, and no limit on Shopify Plus. Collaborators and staff who only use point of sale (the in-store checkout) don’t count toward the total.

So on Starter or Basic, your agency comes in as a collaborator, which takes joining the Shopify Partner program. For your people to be added as staff, Shopify says the store needs Grow or a higher plan.

Coming in as a Shopify collaborator

The process starts with a 4-digit collaborator request code. The owner finds it under Settings > Users, in the Security section, and passes it to you. Once the owner generates a new code, older ones no longer work.

Your agency sends a request with that code. The owner reviews it under the Requests filter on the Users page and accepts or rejects it. Each request comes with a role that Shopify builds from the permissions you asked for. The owner can trim that role before accepting and change it at any time after.

Two rules affect daily work. Partners have to turn on two-step authentication, a second check after the password, or the collaborator account can’t sign in. And a collaborator who hasn’t signed in to the store for 90 days loses access automatically. The owner can reactivate them from the user’s page.

Removing people from a Shopify store

For staff, the user’s page under Settings > Users offers three actions. Suspend blocks sign-in and can be reversed. Remove takes the person off the store for good. Revoke access signs the person out on one device or app. They can sign in again unless you also suspend or remove them. Only the store owner and Administrators can manage users on a single store outside Shopify Plus.

For a collaborator, the owner removes the collaborator account. Shopify Help warns that this can’t be undone. To return, the Partner sends a new request.

Shopify keeps two records you can check afterward. The user management activity log lists each time a user or role was created, edited or deleted, with a timestamp and the user involved. Login history shows each user’s five most recent sign-ins. Each one has the date, IP address (the network address the connection came from), internet provider, location, and browser and operating system. Shopify Help doesn’t say how long either record is kept.

BigCommerce user accounts

BigCommerce gives each person a user account in the store’s control panel. Its help center recommends one account per person, with access limited to that person’s work. The store owner, or a user with the Add Users permission, creates the account under Account Settings > Users from the person’s email address. The person then sets their own password, because BigCommerce doesn’t let the owner set it for them.

That design suits agencies. If the email address is already a user on another BigCommerce store, the person keeps their existing password and picks the store after signing in. A staff member who works on several client stores uses one login for all of them, and each owner still decides that person’s permissions in their own store.

Permissions come as built-in roles (Sales Staff, Sales Manager, Store Administrator) or as a custom set. Each permission is a checkbox, such as Manage Orders, Edit Products or Export Customers. Some need another permission turned on first.

BigCommerce treats two kinds of access differently. High-risk permissions, such as installing apps or creating API accounts (keys that let other software act on the store), can be granted only by the store owner. Both the owner and that user must have two-factor authentication set up. Marketplace apps are opened to each user under Single Click Apps, and only apps that support more than one user appear in that list.

BigCommerce keeps a per-user record as well. Its Staff Action Log, under Settings > Store logs, lists control panel changes with the user, their IP address, the action and the time, going back 365 days. Viewing it takes the Store Logs permission.

To take someone off the store, set their account to Inactive, or delete it with the Delete Users permission. BigCommerce suggests Inactive, because deleting a user removes their name from the Staff Action Log.

BigCommerce’s store owner FAQ recommends against making a developer or agency the store owner. Instead, it says to create a user account for them with only the permissions their tasks need.

What store permissions leave out

In Shopify, inviting staff, sharing the request code, accepting requests and removing users all belong to the owner or an Administrator. So agree at the start who on the client’s side will take those steps, and how fast.

In BigCommerce, only the owner can see billing, change the plan, buy themes and grant high-risk permissions. If your work includes installing or removing apps, the owner either grants that permission or does it. Apps that only the owner can use never appear in a user’s list.

Where owner-only tasks are part of the job, the owner’s login ends up shared for that part. What to decide about the shared logins that remain is covered in managing client accounts at an agency.