Shopify collaborator access for agencies: codes, roles and removal

When Theo at Northside Studio starts on the theme for Dana at Harbor Fitness, there are three ways into her Shopify store: her owner login, a staff account, or a collaborator account. Shopify built the third for agencies and freelancers, and it is the one to ask for. A collaborator request needs no password at all, and the owner stays in control of what you can do.

Menu names below come from Shopify's Help Center and developer docs at the time of writing. Shopify has moved partner store access from the Partner Dashboard into the Dev Dashboard, so instructions written before the move may say Send collaborator request. In the Dev Dashboard the same flow is called Request store access.

Why a collaborator account, not a staff user or the owner login

• It doesn't use a seat. Collaborators don't count toward the store's user limit. Staff seats depend on the plan: 0 on Basic and Starter, 5 on Grow, 15 on Advanced and unlimited on Shopify Plus.
• It works on the smallest plans. Basic and Starter stores can't add staff users at all, but Shopify says that limit applies to staff accounts only, so collaborators still work.
• The owner approves the permissions. You ask for what you need, and the client reviews a role built from your request, edits it if she wants, and accepts.
• Your actions carry your name. Collaborators must turn on two-step authentication, and your name appears on your changes in timelines such as the store activity log.

The owner login is the worst option: two-step codes get passed around, every change looks like the owner's, and ending your access means a password reset.

Skip the back and forth. Let one link walk your client through it

Step 1: the client finds the collaborator request code

Every store has a 4-digit collaborator request code, and Shopify's collaborator accounts page says only partners the merchant shares it with can request access. Dana does this:

1. In her Shopify admin, go to Settings > Users.
2. Click Users if the store is part of an organization, or Users & permissions if it isn't.
3. Click Security.
4. Click the 4-digit code to copy it, and send it to you.

To retire a code, she clicks Generate new code in the Collaborators section of the same Security page, and every earlier code stops working.

Also ask for the store's permanent myshopify.com address, such as harbor-fitness.myshopify.com, because the request form doesn't accept custom domains. The exact clicks are on our Shopify access page.

Step 2: the agency sends the request

You need a Shopify Partner account, two-step authentication, and a role in your partner organization that includes the Collaborator relationships permission (see Shopify's Dev Dashboard user permissions). Shopify may also ask your organization to verify its identity, and the request page says so when it does. Then, in the Dev Dashboard:

1. Select Stores in the left sidebar.
2. Select Request store access.
3. Enter the store's permanent myshopify.com URL.
4. Enter the 4-digit collaborator request code.
5. Select the permissions you need.
6. Select Send request.

Ask only for what the job needs. For theme work that is usually Online store > Themes and Edit code. Shopify's store permissions list notes that Themes includes Shopify CLI access, and installing a Theme Store theme also needs Manage and install apps and channels. Leave Approve app charges, Manage payments settings and Edit billing payment methods and pay invoices with the client unless the work needs them.

Shopify's collaborations docs list some limits:

• A store can have at most two pending collaborator requests at once, from all organizations combined.
• Your organization can have at most 10 pending requests that were sent without a code.
• Your organization must be at least 30 days old to send a request, unless the store requires a code or already has one of your organization's apps installed.
• The request fails if a staff user on the store has your organization's partner business email, so that staff account has to go first.

Shopify's merchant help treats the code as required, so ask for it every time.

One link per client, with every step checked. Reserve a founding place

Step 3: the client accepts

Dana gets an email and a notification on her Shopify Home. On a single store, only the store owner or a user with the Administrator role can see and grant the request. In a multi-store organization, the organization owner or an Organization administrator can edit and accept the auto-generated role, while store owners and user administrators can only assign roles that already exist.

1. Go to Settings > Users.
2. Click the Requests status to filter open requests.
3. Click your request.
4. In Roles, review the auto-generated role. She can edit its permissions, rename it, or assign existing roles instead.
5. Click Accept request.

The request may show Partner since, Signed up from and Request sent from, with "(possible VPN)" when it applies, so tell the client your organization's name and country in advance. If she sees "The role name already exists", she removes the auto-generated role and assigns an existing one.

Shopify doesn't document an email to the partner when a request is accepted. The docs only say the store appears in your Dev Dashboard Stores list with the status Active, so check there. Until then it shows Request sent, and a declined request shows a dash. If the client declines by mistake, you can't clear it yourself: Shopify's FAQ says to contact Partner Support so you can send a new request.

Log in to the store from the Stores page at least once. Shopify requires that before you can use your collaborator access in the Shopify mobile app.

What happens over time

The collaboration belongs to your organization, not one person. It expires when nobody from your organization logs in to the store for 90 days, and one login in that window keeps it active. When it lapses, the row shows Access expired, and there are two ways back:

• The agency re-requests: in Stores, filter by Type is Collaboration, open the three-dot menu on the row and select Re-request access. The client approves the new request.
• The client reactivates: she opens your account under Users and permissions, then Actions > Reactivate user.

Sending this to a client? Send one link instead

Removing access at the end of a project

Removal is permanent from either side, and coming back needs a new request. Your past actions stay in the store's timelines.

The client removes you:

1. Go to Settings > Users, then Users (organization) or Users & permissions (single store).
2. Click the collaborator's name.
3. In an organization, click Actions > Remove. On a single store, click Remove with your name in the Remove collaborator account section.
4. Click Remove in the confirmation dialog.

The agency removes itself: in Stores, filter by Type is Collaboration, open the three-dot menu, select Remove access and confirm. This ends access for your whole organization. A request still at Request sent can be withdrawn from the same menu with Cancel request.

The tidiest exit is both: you remove access, then the client generates a new code. For the rest of the offboarding list, see the end-of-project handover checklist.

Collaborator account vs staff user

Skip the back and forth. Let one link walk your client through it

What to ask the client for

Send one message: "Please send us the 4-digit collaborator request code from Settings > Users > Security, and your store's myshopify.com address. A request from Northside Studio will follow. Check the role it suggests, then click Accept request."

One link per client, with every step checked. Reserve a founding place

Doing this for every client?

Get Set Keys gives each client one link that walks them through finding the code and accepting your request, and checks each step is done. The client stays the owner, their password stays with them, and Porter, the AI setup helper on every link, answers their questions as they go. You can reserve a founding place before it launches in November 2026.