# Getting agency staff into a client's Shopify or BigCommerce store

Shopify lets staff in by invitation on Grow and up, or as a Partner collaborator. BigCommerce gives each person a user account. Neither needs the owner's login.

Updated: October 16, 2026

Shopify and BigCommerce both let the store owner bring in your staff without handing over the owner's login. For a client selling on Amazon instead, see [Amazon Seller Central user permissions](/guides/agency-accounts/amazon-seller-central-user-permissions). The general idea is in [what is delegated access?](/guides/agency-accounts/what-is-delegated-permission).

## Who can sign in to a Shopify store

A Shopify admin has three kinds of people: the store owner, staff, and collaborators. Staff are invited by email from Settings > Users and given one or more roles. Shopify Help describes a role as the permissions one job needs. A person with two roles gets the permissions of both added together. Invitations expire after 7 days, and a lapsed one means removing the person and adding them again.

Collaborators are Shopify Partners (businesses in Shopify's partner program) that the owner has let into the store.

| Kind | How they get in | Permissions | Counts toward the user limit |
| --- | --- | --- | --- |
| Store owner | Owns the store | Everything | No |
| Staff | Invited by the owner or an Administrator | One or more roles, added together | Yes |
| Collaborator | Partner requests, owner accepts | A role built from the request, which the owner can edit | No |

The plan sets how many staff a store can have. Shopify's plan table lists 0 users on Starter and Basic, 5 on Grow, 15 on Advanced, and no limit on Shopify Plus. Collaborators and staff who only use point of sale (the in-store checkout) don't count toward the total.

So on Starter or Basic, your agency comes in as a collaborator, which takes joining the Shopify Partner program. For your people to be added as staff, Shopify says the store needs Grow or a higher plan.

## Coming in as a Shopify collaborator

The process starts with a 4-digit collaborator request code. The owner finds it under Settings > Users, in the Security section, and passes it to you. Once the owner generates a new code, older ones no longer work.

Your agency sends a request with that code. The owner reviews it under the Requests filter on the Users page and accepts or rejects it. Each request comes with a role that Shopify builds from the permissions you asked for. The owner can trim that role before accepting and change it at any time after.

Two rules affect daily work. Partners have to turn on two-step authentication, a second check after the password, or the collaborator account can't sign in. And a collaborator who hasn't signed in to the store for 90 days loses access automatically. The owner can reactivate them from the user's page.

## Removing people from a Shopify store

For staff, the user's page under Settings > Users offers three actions. Suspend blocks sign-in and can be reversed. Remove takes the person off the store for good. Revoke access signs the person out on one device or app. They can sign in again unless you also suspend or remove them. Only the store owner and Administrators can manage users on a single store outside Shopify Plus.

For a collaborator, the owner removes the collaborator account. Shopify Help warns that this can't be undone. To return, the Partner sends a new request.

Shopify keeps two records you can check afterward. The user management activity log lists each time a user or role was created, edited or deleted, with a timestamp and the user involved. Login history shows each user's five most recent sign-ins. Each one has the date, IP address (the network address the connection came from), internet provider, location, and browser and operating system. Shopify Help doesn't say how long either record is kept.

## BigCommerce user accounts

BigCommerce gives each person a user account in the store's control panel. Its help center recommends one account per person, with access limited to that person's work. The store owner, or a user with the Add Users permission, creates the account under Account Settings > Users from the person's email address. The person then sets their own password, because BigCommerce doesn't let the owner set it for them.

That design suits agencies. If the email address is already a user on another BigCommerce store, the person keeps their existing password and picks the store after signing in. A staff member who works on several client stores uses one login for all of them, and each owner still decides that person's permissions in their own store.

Permissions come as built-in roles (Sales Staff, Sales Manager, Store Administrator) or as a custom set. Each permission is a checkbox, such as Manage Orders, Edit Products or Export Customers. Some need another permission turned on first.

BigCommerce treats two kinds of access differently. High-risk permissions, such as installing apps or creating API accounts (keys that let other software act on the store), can be granted only by the store owner. Both the owner and that user must have two-factor authentication set up. Marketplace apps are opened to each user under Single Click Apps, and only apps that support more than one user appear in that list.

BigCommerce keeps a per-user record as well. Its Staff Action Log, under Settings > Store logs, lists control panel changes with the user, their IP address, the action and the time, going back 365 days. Viewing it takes the Store Logs permission.

To take someone off the store, set their account to Inactive, or delete it with the Delete Users permission. BigCommerce suggests Inactive, because deleting a user removes their name from the Staff Action Log.

BigCommerce's store owner FAQ recommends against making a developer or agency the store owner. Instead, it says to create a user account for them with only the permissions their tasks need.

| | Shopify staff | Shopify collaborator | BigCommerce user |
| --- | --- | --- | --- |
| Condition | Grow plan or higher | Your agency is a Shopify Partner | No plan condition in the user help articles |
| Who adds you | Owner or Administrator | You request, owner accepts | Owner or a user with Add Users |
| Permission unit | Roles, added together | A role built from the request | Single permissions or a built-in role |
| Removal | Suspend or remove | Remove (can't be undone) | Set inactive, or delete |
| Activity record | User changes and last 5 sign-ins | Same | Staff Action Log: user, IP address, action and time, kept 365 days |

## What store permissions leave out

In Shopify, inviting staff, sharing the request code, accepting requests and removing users all belong to the owner or an Administrator. So agree at the start who on the client's side will take those steps, and how fast.

In BigCommerce, only the owner can see billing, change the plan, buy themes and grant high-risk permissions. If your work includes installing or removing apps, the owner either grants that permission or does it. Apps that only the owner can use never appear in a user's list.

Where owner-only tasks are part of the job, the owner's login ends up shared for that part. What to decide about the shared logins that remain is covered in [managing client accounts at an agency](/guides/agency-accounts).


## Frequently asked questions

**Can a client on Shopify's Basic plan add our staff?**

Not as staff. Shopify lists 0 users on Starter and Basic, so staff accounts need Grow or a higher plan. On Starter or Basic, your agency gets in as a Shopify Partner through a collaborator account.

**Do collaborator accounts count toward Shopify's user limit?**

No. Collaborator accounts don't count toward a store's user limit, and neither do staff who only use point of sale.

**What do we do in Shopify when a staff member leaves?**

Staff are suspended or removed under Settings > Users. A collaborator account is removed by the owner. That can't be undone, and coming back takes a new request from the Partner.

**Should a BigCommerce client make our agency the store owner?**

No. BigCommerce advises against giving store ownership to a developer or agency. It suggests a user account with only the permissions the work needs.

**Can we see which staff member did what?**

Shopify keeps a log of user and role changes and each user's last five sign-ins. BigCommerce's Staff Action Log lists control panel changes with the user, IP address and time, for 365 days.

## Sources

- [Shopify Help Center: Users](https://help.shopify.com/en/manual/your-account/users)
- [Shopify Help Center: Roles](https://help.shopify.com/en/manual/your-account/users/roles)
- [Shopify Help Center: Inviting users](https://help.shopify.com/en/manual/your-account/users/invite-users)
- [Shopify Help Center: Maximum users on each plan](https://help.shopify.com/en/manual/your-account/users/users-plan-requirements)
- [Shopify Help Center: Managing users from the Shopify admin](https://help.shopify.com/en/manual/your-account/users/manage-users)
- [Shopify Help Center: Collaborator accounts](https://help.shopify.com/en/manual/your-account/users/security/collaborator-accounts)
- [Shopify Help Center: User activity and login history](https://help.shopify.com/en/manual/your-account/users/security/user-management-activity-log)
- [BigCommerce Help Center: Users](https://support.bigcommerce.com/s/article/Users?language=en_US)
- [BigCommerce Help Center: User Roles and Permissions](https://support.bigcommerce.com/s/article/User-Permissions?language=en_US)
- [BigCommerce Help Center: Store Owner User Role and Permissions](https://support.bigcommerce.com/s/article/Store-Owner?language=en_US)
- [BigCommerce Help Center: Using Store Logs](https://support.bigcommerce.com/s/article/Using-Store-Logs?language=en_US)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** Where Shopify staff or collaborator accounts or BigCommerce user accounts work, use them first. Junify is for logins that exist only once, such as the store owner's login for owner-only tasks, or an app without separate user logins. Your admin adds the login to Junify, and staff verify on their own phone and click to sign in. They're never told the password, and each use is recorded by person.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=shopify-bigcommerce-staff-permissions)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Account clauses an agency should propose in its client contract](/guides/agency-accounts/account-clauses-for-service-providers): Propose five: account handover, who may use accounts, records, incident notice, and offboarding. Keep your own promises apart from what the client must do.
- [How to write client account handling into your agency's security policy](/guides/agency-accounts/agency-security-policy-for-clients): Write a short public policy, an internal policy for staff, and an access summary for each client. Rewrite template rules for logins the client owns.
- [Amazon Seller Central user permissions, and how to give an agency access](/guides/agency-accounts/amazon-seller-central-user-permissions): Seller Central Help says not to share logins. On a Professional plan, the seller invites staff as employees and authorizes your agency as a Service Provider.