Staff access insteadof passwords: how werequest Shopify access

In short

Many clients email us their admin login at the start of a project. Well meant, but needlessly risky. Shopify gives agencies a dedicated route: collaborator access for partners. All we need is the store address and a collaborator request code. We send an access request, and the client decides which areas we can see. After the project, access can be removed with one click.

The case

A shared admin password has several problems: it ends up in inboxes, often never gets changed, and later nobody knows exactly who still has it. On top of that comes the verification code, which lands with the owner on every login. For agency and client alike, that's clunky and insecure at the same time.

How access works via Shopify

1. The client gives us their store address, the one ending in “myshopify.com”.
2. They give us the collaborator request code, which they'll find in the settings under Users.
3. We send an access request from our Partner account covering the areas we need for the project.
4. The client reviews and approves the request. They see exactly which permissions we get.
5. After the project, the client can remove or restrict the access.

What comes on top outside Shopify

Not everything runs through Shopify access. Depending on the project, we also need access to domain management, Search Console, the email tool or individual apps. There, too, we ask for our own user accounts instead of shared passwords wherever possible.

Your takeaways

• Don't share your admin password. Shopify has a safer route for agencies.
• You stay in control. You see which permissions are granted and can revoke them anytime.
• Clean up after the project. Remove access that's no longer needed.
• Think of the systems outside Shopify. There, too, individual user accounts beat shared logins.

Is your project starting soon? We'll send you a short guide on how to give us access securely.