How to give an agency collaborator access to your Shopify store

The merchant copies the 4-digit collaborator request code from Settings > Users > Security in the Shopify admin, and sends it with the store's myshopify.com address to the agency. The agency sends a collaborator request from its Dev Dashboard under Stores > Request store access. The merchant then accepts it under Settings > Users, after checking the permissions in the collaborator's role.

This page covers both sides: the merchant who owns the store, and the agency or freelancer who needs to work in it.

Collaborator or staff account

Shopify has two ways to let someone into the admin:

• Collaborator account: for Shopify Partners, such as agencies and freelancers. The Partner requests access from their own Dev Dashboard, and you approve it with the permissions you choose. Shopify says collaborator accounts don't count toward your store's user limit.
• Staff account: a regular user account. Shopify's plan limits page says staff users come with the Grow plan and higher, and count toward the plan's limit. On the Basic and Starter plans the staff limit is zero, but collaborators are exempt.

For an agency, use a collaborator account: it is the type Shopify describes for Partners, freelancers and agencies, and it uses no staff seat. A few limits apply to collaborators, according to Shopify's collaborator accounts page:

• They must turn on two-step authentication, or they cannot log in to your store.
• They have no access to the Shopify POS app or the Point of Sale channel.
• You can't transfer store ownership to a collaborator.
• In a single store, you can't give a collaborator the Administrator store role.

If the same agency runs the store's email or SMS marketing in Klaviyo, see the Klaviyo guide.

Before you start

The merchant needs the right role. For a single store, only the store owner and users with the Administrator store role can see collaborator requests and grant access. In an organization, the organization owner and users with the Organization administrator role can edit and accept the role a collaborator asks for. Store user administrator and Organization user administrator can only assign existing roles.

The agency needs, according to Shopify's developer documentation:

• a Shopify Partner account
• the permission to manage collaborations in its organization
• a verified identity, if Shopify asks for one; the request page then shows Action required

Merchant: find and send the code

1. From your Shopify admin, go to Settings > Users.
2. If your store is part of an organization, click Users. If it is not, click Users & permissions.
3. Click Security.
4. Click the 4-digit code to copy it.
5. Send the code to the agency, together with your store's permanent myshopify.com address. Shopify does not accept your own domain in a request.

Only Partners you give the code to can request access to your store. To make an old code useless, go to Settings > Users > Security and, in the Collaborators section, click Generate new code.

Agency: send the request

1. Log in to the Dev Dashboard.
2. Select Stores in the left sidebar.
3. Select Request store access.
4. Enter the store's permanent myshopify.com URL.
5. Enter the merchant's 4-digit collaborator request code.
6. Select the permissions you need.
7. Select Send request.

In the legacy Partner Dashboard, this was called Send collaborator request. If your organization already has one of its apps installed on the store, you can request access without a code.

The store shows Request sent in your Stores list until the merchant approves, and Active after. Shopify builds the collaborator's role from the permissions you ask for, so ask only for what the work needs and say why. Shopify's own advice to merchants is to ask the agency why, if they are unsure about a permission.

Merchant: accept the request and set the role

Shopify sends you an email and a notification on your Shopify Home when a request arrives. To accept it:

1. From your Shopify admin, go to Settings > Users.
2. On the Users page, click the Requests status to show open collaborator requests.
3. Click the request.
4. In the Roles section, review the role Shopify created from the agency's request. You can change its permissions and its name, assign one or more existing roles instead, or create a new role.
5. Click Accept request.

The request may show details about the Partner: Partner since, Active collaborations, Signed up from and Request sent from, sometimes with (possible VPN). Shopify asks you to check that you recognize the Partner and expected the request, review the permissions, contact the Partner if anything is unexpected, and grant only the permissions they need. You can also limit a collaborator to specific apps and channels.

If you do not want the request, click Reject request instead of Accept request. Shopify says you should not accept a request you were not expecting or from a sender you don't recognize.

Troubleshooting

The merchant cannot find the code

The last menu step depends on the store. Stores in an organization show Users, and other stores show Users & permissions, before Security. Shopify says only eligible users can manage collaborator accounts, so if you cannot see the code, ask the store owner.

The code does not work

The merchant may have generated a new code, which makes every older code stop working. Ask for the current one. Also check that you entered the myshopify.com address, not the store's own domain.

The request fails

Shopify's developer documentation lists these limits:

• A store can have a maximum of two pending collaborator requests, counting every organization. A request fails until one of them is resolved.
• An organization can have a maximum of 10 pending requests sent without a code.
• An organization must be at least 30 days old to send a request, unless the store requires a code or already has one of its apps.
• A request fails if a staff member on the store uses the organization's partner business email. Ask the store owner to remove that account.

The merchant declined by mistake

The agency cannot clear a declined request itself, and requesting again fails. Shopify's answer is for the agency to contact Partner Support, which adjusts the Partner's account so it can send a new request.

Access expired after 90 days

Collaborator access expires when nobody from the agency's organization logs in to the store for 90 days. The merchant can bring it back: on the Users and permissions page, click the user, then Actions and Reactivate user. The agency can also find the store with the Access expired status in its Stores list and choose Re-request access from the row's menu.

"The role name already exists"

If this error appears when you accept, remove the role Shopify created and assign one or more existing roles to the collaborator instead.

The collaborator cannot log in

They need two-step authentication turned on. To use the Shopify mobile app, they must first log in once from the Stores page in their Dev Dashboard.

Remove a collaborator later

1. From your Shopify admin, go to Settings > Users.
2. Click Users (organization) or Users & permissions (single store).
3. Click the collaborator's name.
4. In an organization, click Actions > Remove. In a single store, go to the Remove collaborator account section and click Remove followed by the collaborator's name.
5. Confirm with Remove.

Removal is permanent. The collaborator's name and actions stay in the store's activity log and order timelines. If you want to work with them again, they send a new request. An agency can also end the collaboration itself with Remove access in its Stores list, which removes its whole organization's access. Our guide to removing an old agency's access covers Meta and Google.