How to give a Shopify developer access without handing over your store

Give developers a collaborator account, never your login

The right way to let a freelancer or agency into a Shopify store is a collaborator account. It is free, it gives them only the sections you allow, and you can remove it without touching anyone else's access.

Shopify's page on collaborator accounts sets out what makes them the safer option:

• They need two-step authentication. A Partner without it cannot log in to your store.
• They never become owners. You cannot transfer store ownership to a collaborator.
• They cost nothing against your plan. Collaborators do not count toward your user limit, and there is no cap on how many you add.
• They lapse on their own. If a collaborator has not logged in for 90 days, their access expires automatically.
• They leave a trail. Their name stays in the store activity log and order timelines, even after you remove them.

Sharing the owner email and password does the opposite. The developer gets every permission, including billing and the power to deactivate the store, and you cannot tell their changes from yours. Shopify's guidance for Partners on working on client stores says asking a merchant for their password, or using their credentials, is prohibited. A developer who asks for your login is either new to Shopify or ignoring its rules, and both are worth knowing before you hire them.

How to give a developer collaborator access, step by step

Access takes three moves: you share a code, the developer sends a request, and you approve it with the permissions you choose. The whole exchange takes a few minutes.

1. Find your request code. In the Shopify admin, go to Settings, Users, then Security. On a store that is not part of an organization, the middle step is labelled Users & permissions. Click the 4-digit code to copy it. Only Partners who have the code can request access.
2. Send the code to the developer, along with the store's myshopify.com address. They request access from the Stores page of their Dev Dashboard. Shopify may ask them to verify their identity first.
3. Open the request. You get an email and a notification on Shopify Home. On the Users page, filter by the Requests status.
4. Check who is asking. The request can show when they became a Partner, a rough count of their active collaborations, the country they signed up from and the country the request came from, flagged "(possible VPN)" where relevant. If any of it surprises you, ask the developer before going further.
5. Set the role. Shopify creates a role named after the collaborator and your store, holding whatever permissions they asked for. Edit it down to what the job needs, or assign an existing role instead.
6. Click Accept request. To refuse, click Reject request, which also deletes the auto-generated role.

On a single store, only the owner and users with the Administrator store role can see and approve requests, and the Administrator role cannot be given to a collaborator. Once the work is under way, click Generate new code in the same Security section so the old code stops working. That way a code shared in an email thread months ago cannot be used by someone else.

Grant the permissions the job needs, and keep money with the owner

Collaborators can request any permission your store has, so treat the request as a draft you edit before accepting. Give each developer the smallest set that lets them do the work, and keep the permissions that move money or data with the owner.

Shopify groups store permissions into 20 categories, from Orders and Products to Online store, Store settings and Finance. Roles live under Settings, Users, Roles, and one user can hold more than one role. This is how we would set them for common jobs:

A few permissions deserve a deliberate yes. Shopify marks several of them as sensitive, and the rest move money, customer data or your domain:

• Customer data. Request data, which Shopify marks sensitive, exports a customer's data as a CSV. Erase personal data requests erasure of a customer's data, and Merge combines customer profiles.
• Payments. Charge credit card, Record payments and Capture payments under Orders, and Manage payments settings under Store settings, which Shopify marks sensitive and which controls payment providers, payment methods and fraud prevention. For an Indian store, a wrong change here could switch off Razorpay or COD at checkout.
• Billing. Edit billing payment methods and pay invoices, and View tax documents, both marked sensitive.
• App charges. Approve app charges lets someone install apps and themes that carry one-time or subscription charges. Keep it with the owner so every new charge is your decision.
• Domains. Transfer domain to another Shopify store moves your domain away.

Permissions can also be limited to specific apps and sales channels, which helps when an agency only runs one app, such as reviews or subscriptions. Some actions never leave the owner: only the store owner can deactivate the store.

Staff accounts are for your team, and Basic has none

A staff account is a seat for someone who works for you, and Shopify counts them against your plan. Collaborators are for outside developers, and they are the only option on the smaller plans.

Shopify's user limits by plan are:

Many Indian D2C brands start on Basic, which Shopify's India pricing page lists at ₹1,994 a month on monthly billing, with no staff accounts included. Grow, at ₹7,447 a month, is the first plan with staff seats. On Basic, a collaborator account is the only way to give anyone access without sharing the owner login, and it costs nothing extra.

Shopify's own Partner guidance treats a staff account as the exception, to be used only for a task a collaborator account cannot do. Its example is testing an app in the Shopify admin on a phone. If you do create one for a developer, keep two-step authentication required. Shopify recommends requiring it for new users, and the setting sits in each user's Secure sign-in method section under Settings, Users. Shopify's page on two-step authentication notes that Plus stores can require it for every user at once.

Theme-only work and custom apps have their own routes

Some developers need less than admin access. A theme developer working in code can use a Theme Access password, and an integration that talks to the API needs a custom app, not a person's login.

Theme Access. Shopify's free Theme Access app creates passwords for developers who work on themes with Shopify CLI. A password is scoped to write access to themes only, so it cannot open orders, customers or settings. The owner, or a user with the Themes permission under Online store, installs the app and creates a password for the developer. The developer gets an email link that expires after 7 days or once they view it, and the password can be seen only once. Deleting the password from the app's Passwords page ends their access to your themes.

Custom apps. A connection to an ERP, a warehouse system or a reporting tool runs through a custom app. Shopify's page on custom apps says they are now created and managed in the Dev Dashboard, by users with the App developer role, and that collaborator accounts cannot access the Dev Dashboard. Custom apps made in the admin before January 1, 2026 are treated as legacy and can still be managed there. Each custom app's App settings page shows the staff or collaborator account tied to it. Check that field whenever a developer leaves, so warnings about the app reach someone who still works with you.

Flow automations now need matching permissions

Under a change Shopify announced on 28 October 2026, a developer building Shopify Flow workflows needs the Flow automations permissions plus the permission for every step in the workflow. Without them they can draft workflows, but cannot test or turn them on.

Shopify's changelog post describes the change. Flow used to have a single app permission. It now uses two permissions under Settings, Users, Roles: "View, create, and delete automations" and "Manage connections and secrets". Flow also checks each step against the user's other permissions. A workflow with the Add customer tags action needs Edit customers, for example. A user without the step permissions can still build and save drafts, but cannot test, turn on, run or retry that workflow.

Workflows already switched on keep running, and users who had Flow access were given the new permissions automatically. The practical effect is on new work. If you hire someone to build the automations in our guide to Shopify Flow, grant the permissions for the actions they will use, or test and switch on their workflows yourself. Only give "Manage connections and secrets" if their workflows connect to outside services.

Offboard a developer in one sitting

When the engagement ends, remove the access the same day. Most stray access left after an agency moves on sits outside the Users page, so work through the whole list.

1. Remove the collaborator. Open their name on the Users page and use the Remove collaborator account section, or Actions, then Remove, on an organization. Removal is permanent. To come back, they must send a new request.
2. Suspend or remove staff accounts you created for them. Shopify's page on managing users covers both: Actions, then Suspend, blocks login and can be reversed, and Actions, then Remove, cannot be undone. Revoke Access next to each device logs them out of it.
3. Delete their Theme Access passwords.
4. Check custom apps. Reassign the account tied to each app, and uninstall or delete apps nobody uses.
5. Review installed apps. Agencies often add apps for one task and leave them billing. Our Shopify app audit walks through what to keep and what to remove.
6. Generate a new collaborator request code.
7. Close the doors outside Shopify. Domain registrar and DNS, Google Analytics, Search Console, Merchant Center, Meta Business Manager, the email platform and any GitHub repository that holds your theme.

Doing this at the end of every engagement takes a few minutes. Leaving it for a yearly clean-up means working out, months later, which agency set up which app, password and connection.

Put customer data access in a written contract

A developer with access to orders and customers is handling your customers' personal data, so the access belongs in a written agreement. India's data protection law is moving to require exactly that.

The Digital Personal Data Protection Act, 2023 treats your brand as the Data Fiduciary and an agency processing data on your behalf as a Data Processor. Section 8 says you may involve a Data Processor only under a valid contract, that you remain responsible for what the processor does on your behalf, and that you must take reasonable security safeguards to prevent a breach. The DPDP Rules notified in November 2025 bring most business obligations into force in phases over 18 months, so ask your lawyer which apply to you and from when. The operational point holds either way: the permissions you grant are part of those safeguards.

Three habits cover most of it. Write the scope of access into the engagement letter. Grant customer permissions only to developers whose work needs them, and leave Request data and customer exports off by default. Remove access when the contract ends, using the list above.

A maintenance retainer should spell out the same things: who has access, at what level, and how it is removed. Our guide to what a maintenance retainer should include covers the rest of that agreement, and our Shopify maintenance page sets out how we look after stores. If you want a second opinion on who has access to your store today, you can reach us through the contact page.