Your agency has asked for access to BigCommerce. You don't need to share your password for it. BigCommerce lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against BigCommerce's own help pages in November 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. Store Administrator is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| Store Administrator | Every Sales Staff, Sales Manager and System Admin permission: orders, products, customers, settings, store design and users. API accounts and apps need high-risk permissions too. | Usually the right one |
| Sales Manager | Sales Staff permissions plus products, categories, brands, inventory, exports and analytics reports. | If the work needs it |
| Sales Staff | Orders, returns, customers, promotions, coupons, web pages and banners. | If the work needs it |
Add your agency to BigCommerce
Open Users If you have more than one store, check that your store is the store shown.
- Sign in to your BigCommerce control panel and go to Settings, then Users.
- Click Create a User Account.
- Enter your agency's email address, leave the account status as active and choose a language for the control panel.
- Select Store Administrator as the User Role and save the user.
- If your agency needs API accounts, apps or channels, open the Action menu (...) for your agency's email address, select Edit and tick them in the high-risk permissions section.
Staff accounts are included in every plan. Only the store owner can grant high-risk permissions, and both the owner and your agency then need two-factor authentication; BigCommerce also expects every other permission alongside them, as Store Administrator has.
How you both know it worked
BigCommerce emails your agency an invitation from bigcommerce.com. Once they accept it, they show in your BigCommerce account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- In your BigCommerce control panel, go to Settings, then Users.
- Open the Action menu (...) for your agency's email address and delete the user.
- Go to Settings, then Store-level API accounts. For each account your agency created, select Delete from its Action menu (...) and click Delete to confirm.
Do you have to share your password?
No. Every step above uses BigCommerce's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one GetSetKeys link instead of a page like this. It walks the client through BigCommerce and the other platforms the project needs, and checks that each step is done.