At some point, you will need to let a developer, designer or agency into your Shopify store. How you do that matters. Sharing your own login is the most common mistake I see, and it creates security, accountability and billing problems that are easy to avoid.
The right way is a collaborator account.
What is a Shopify collaborator account?
A collaborator account lets a Shopify Partner, such as a developer or agency, access your admin with only the permissions you approve. It is separate from your staff accounts, and Shopify confirms that collaborators don't count towards your store's user limit.
Each collaborator logs in as themselves. You can see who has access, what they can do, and remove them at any time.
Why not just share your login?
- Security. Your owner login controls billing, payouts and the ability to transfer the store. Nobody else should have it.
- Accountability. If several people use one login, you cannot tell who changed what.
- Two-step verification. Sharing a login means sharing verification codes, which defeats the point.
- Clean exits. Removing a collaborator takes a minute. Changing a shared password affects everyone.
How to give collaborator access
- In your Shopify admin, go to Settings, then Users. If your store isn't part of an organisation, click Users & permissions.
- In the Security section, find your 4-digit collaborator request code. Only Partners you give this code to can request access.
- Give the code to the developer or agency you are working with. They send an access request from their Partner account, choosing the permissions they need.
- You receive an email and a notification on your Shopify Home. Go to Settings, then Users, click Requests and open the request.
- Check you recognise the Partner and expected the request. Review the role and permissions, change them if needed, then click Accept request.
Only the store owner, or a user with the Administrator role, can approve collaborator requests.
Which permissions should you grant?
Grant only what the job needs. A theme developer usually needs access to themes and the online store, not to customers, orders or payment settings. Someone helping with marketing may need discounts and analytics, but not apps or billing. If a request asks for everything, ask why.
How to remove access when the work ends
Go to Settings, then Users, click the collaborator's name and choose Remove. Removal is permanent; if they need access again, they send a new request.
Shopify also expires collaborator access automatically if the account hasn't logged in for 90 days. Even so, I suggest reviewing your list every few months. It is common to find people who finished their work long ago and still have access. If you think your code has been shared too widely, click Generate new code in the Security section and the old one stops working.
A note for developers and agencies
If you are on the other side of this, request only the permissions you need and say so in your request. It shows the store owner you take their security seriously, and it makes approval quicker.
Shopify's own steps are in its collaborator accounts guide, which is worth checking if your admin looks different, as Shopify updates its screens from time to time.
Need help with your store?
If you are about to bring in outside help, my guide on what a Shopify developer costs in the UK will help you plan the budget. To work with me directly, see my freelance Shopify developer page and use the form below.
