Multi-store6 min read
Agency Access to Client Shopify Stores: Staff, Collaborators, AI
Agencies juggle collaborator accounts, staff limits and now AI tools across client stores. The Shopify rules to know and how to keep each person to their stores.
In this guide
An agency with many client stores does not have one access problem, it has one per store. Each store grants access separately and has its own staff limit. Add a freelancer, a virtual assistant and an AI tool or two, and “who can change what, on which store?” becomes hard to answer.
This guide covers the Shopify rules behind client access, how to keep each person to the stores they work on, how to onboard and offboard people cleanly, and how to bring AI tools in without losing track.
Collaborator account or staff account?
There are two ways into a client’s store, and they behave differently:
| Collaborator account | Staff account | |
|---|---|---|
| Who requests it | Your agency, with the store’s request code | The client invites a person |
| Counts toward the plan’s user limit | No | Yes |
| Expires on its own | After 90 days without a login | Not under the collaborator rule; plan removal yourself |
| Best for | Agency work across many clients | A person embedded in one client’s team |
Most agencies use collaborator accounts by default and staff accounts only where a client wants someone treated as part of their own team.
How collaborator accounts work
The rules are worth knowing in detail (Shopify Help Center):
- Access starts with a 4-digit collaborator request code that the store gives you.
- For a single store, only the store owner or a user with the Administrator role can view collaborator requests and grant access.
- The Store user administrator organization role can’t be assigned to collaborators.
- Collaborators don’t count toward the store’s user limit.
- If a collaborator hasn’t logged in to the store within 90 days, their access expires automatically.
- Shopify asks the store to consider carefully which permissions a collaborator needs, and to grant only those.
That 90-day expiry is a useful safety net, but it also catches agencies out: a client you only touch before peak season may need a new request when you come back. Before the holiday rush, log in to every client store you will need, or request access again early.
Staff limits per Shopify plan
When a client adds your team as staff instead, their plan sets the ceiling. Shopify lists the maximum users per plan as 0 on Basic, 5 on Grow, 15 on Advanced and unlimited on Shopify Plus. Collaborator accounts and POS-only staff don’t count toward that limit (Shopify Help Center).
Shopify also advises giving sensitive permissions only to your most trusted users, splitting sensitive tasks across several people so no single account is a weak point, and having staff turn on two-step authentication (Shopify Help Center). For an agency, that means planning access store by store, and keeping refunds and captures behind a named person rather than handing them to everyone who works on the store.
Plan access by role, not by person
Before requesting access, decide what each role in your agency needs on a client store:
| Role | Typical access | Should not have |
|---|---|---|
| Account lead | Orders, products, discounts, reports | Payment settings |
| Developer | Themes, apps, settings needed for the project | Refunds, customer exports |
| Content editor | Products, collections, blog | Orders, refunds |
| Support helper | Orders and customers for the assigned store | Discounts, settings |
Write this down once and apply it to every client. When a client asks why someone has access, you can answer from the table.
Onboarding and offboarding
When someone joins a client account:
- Request collaborator access with only the permissions in your role table.
- Record the store, the person, the permissions and the date in your own access list.
- Ask them to turn on two-step authentication before their first change.
When someone leaves a client or the agency:
- Remove their collaborator account from every client store they worked on. Shopify removes a collaborator from Settings > Users, and removal is permanent (Shopify Help Center).
- Revoke any AI or app connection they created.
- Update your access list and tell the client.
With many clients, step 1 is where things get missed. Your access list is what makes it complete.
Where sign-off goes wrong
Agencies running many client stores often approve changes in Slack threads and spreadsheets, away from the store they change. That works until a client asks “who refunded this order?” and the answer is buried in a chat. A sound setup has four parts:
- One account per person, with a role and the client stores they are assigned to, and nothing else.
- Approval in one place, next to the change itself, for the changes that cost money.
- A record of who did what, so a client’s question has an answer.
- Two-step sign-in for everyone, because roles mean little if a password is phished.
Our guide to approval workflows for live Shopify stores covers how to set approval levels, and changes across multiple Shopify stores covers keeping changes in the right client’s shop.
Bringing AI tools onto client stores
Treat an AI connection like a new team member: decide which stores it reaches, what it may change, and how you will see what it did. Not every tool asks before it acts. Before connecting one to a client store:
- Scope it to one store unless it truly needs more.
- Keep money out of reach. Refunds, cancellations and captures should wait for a person.
- Make its changes visible. You should be able to tell an AI change from a person’s.
- Know how to switch it off for one client, or for all of them.
- Tell the client. An AI tool working on their store is something they should hear from you first.
Read connect AI tools like Claude to your Shopify store with MCP for the basics.
Seasonal and freelance help
Agencies often add freelancers for the holiday peak. Give each one access only to the client stores they cover, set an end date in your access list, and remove access when the season ends instead of waiting for the 90-day expiry. Our guide to seasonal staff access across Shopify stores has a fuller routine.
Agency access checklist
- Role table written and applied to every client
- Access list with store, person, permissions and date
- Two-step authentication on for every account
- Refunds and captures limited to named people
- Each AI connection scoped to the stores it needs
- Offboarding steps run whenever someone leaves a client
- Access to quiet clients renewed before peak season
FAQ
Do Shopify collaborator accounts count toward the staff limit?
No. Collaborator accounts and POS-only staff don’t count toward the plan’s user limit.
How long does collaborator access last?
It stays until it is removed, or until the collaborator hasn’t logged in to the store for 90 days, when it expires automatically.
Who can approve a collaborator request?
For a single store, the store owner or a user with the Administrator role.
How many staff accounts does each Shopify plan allow?
Shopify lists 0 on Basic, 5 on Grow, 15 on Advanced and unlimited on Shopify Plus, not counting the owner, collaborators and POS-only staff.
Should an AI tool get its own access to a client store?
Treat it like a person: scope it to the stores it needs, keep refunds and captures with a human, make its changes recognisable, and agree it with the client first.