How to give a Shopify developer access to your store (safely)

To give a Shopify developer access, send them your 4-digit collaborator request code from Settings > Users > Security, wait for their request, and approve it with only the permissions the job needs. They log in with their own Partner account and two-step authentication, so you never share your password. When the job ends, remove them from the same Users page.

Most store owners I work with have done this the risky way at least once: a WhatsApp message with the owner email and password, then an OTP forwarded at midnight so the developer can get in. It works, and it hands a stranger the keys to billing, payouts and the store itself. Shopify built collaborator accounts so you never have to do that, and the setup takes about five minutes.

If you're still choosing who to hire, start with how to hire a Shopify developer without getting burned and come back here once you've picked someone.

Collaborator account or staff account: which should a developer get?

A freelancer or agency who is a Shopify Partner should get a collaborator account. Staff accounts are for your own employees, and on the Basic plan you don't have any.

That second point surprises people. Shopify's user limits, as of October 2026, are 0 staff accounts on Starter and Basic, 5 on Grow, 15 on Advanced and unlimited on Plus. Collaborators are exempt from those limits entirely. So on Basic, a collaborator account is the only clean way to let anyone else into your admin.

The 2-step row is a real advantage. Shopify says the store owner can't switch on two-step authentication for other staff members, so a staff account is only as secure as that person's habits. A collaborator can't log in to your store at all until they've turned it on.

How do you give a Shopify developer collaborator access, step by step?

You share a code, the developer requests, you approve. Here is the full sequence as Shopify's Help Center describes it in October 2026.

1. Find your request code. In the Shopify admin, go to Settings > Users. If your store is part of an organization, click Users, otherwise click Users & permissions. Then open Security. The 4-digit code is in the Collaborators section. Click it to copy.
2. Send the code to your developer only. Shopify only accepts collaborator requests from Partners who have your code, so treat it like a door key.
3. The developer sends a request from their Shopify Partner account, listing the permissions they want. You get an email and a notification on Shopify Home.
4. Check who is asking. Open Settings > Users and filter by Requests. Shopify shows details for each Partner: how long they've been a Partner, their active collaborations, their sign-up country, the country the request came from, and a "possible VPN" flag. If any of that doesn't match the person you hired, don't accept.
5. Set the role. Shopify creates a role named after the collaborator and your store. Untick everything the job doesn't need, or assign an existing role you've already set up.
6. Click Accept request. The developer can now log in from their own dashboard.

If you ever paste the code somewhere public, or a past freelancer still has it, go back to the Collaborators section and click Generate new code. The old code stops working straight away.

Agencies work the same way. Each person at the agency who needs to work in your store sends a request, and each one appears as a separate named account on your Users page. Ask the agency up front who exactly will be in your store, then match the names when the requests arrive.

Which permissions should you give for each kind of job?

Give the narrowest set that lets them finish. Collaborators can request any store permission, and they will often ask for more than they need because it saves them a second request later. You decide.

The permission names below are the ones Shopify uses in its store permissions reference. Your admin may group them slightly differently, but the labels match.

A few permissions deserve extra care. Shopify's reference flags "Request data" under Customers, "Edit billing payment methods and pay invoices", "Manage payments settings", "View tax documents" and "Manage other payment settings" as sensitive. I almost never need any of them, and you should ask why if a developer requests one.

Customer export is another one I'd hold back. A full customer list with phone numbers is the most valuable thing in a D2C store, and very few jobs need a copy of it.

One honest limit: Shopify's Themes permission covers viewing, changing and publishing themes together, so even an audit role can technically publish a theme. That's fine with someone you trust. With someone you don't, the Theme Access route in the next section is tighter.

When is the Theme Access app the better option?

Use Theme Access when the job is pure theme code and the developer works in Shopify CLI. They get a password that only allows theme changes, and they never see your admin.

The app is free on the Shopify App Store. Once it's installed, you click Create theme password, enter the developer's details, and Shopify emails them a link. Per Shopify's developer docs, that link expires after 7 days or as soon as it's viewed, and the password itself is scoped to write_themes. No orders, no customers, no settings. To end access, open the Passwords page in the app and click Delete next to their name.

It suits a few situations well:

• An overseas freelancer you found recently and haven't worked with yet
• A one-off section build where the developer pushes code from their own machine
• A CI/CD pipeline that deploys theme changes from GitHub

It doesn't suit work in the theme editor, app setup, or anything involving products and settings. For those, a collaborator account with a tight role is the right tool.

What should you never share with a Shopify developer?

Never share your owner login, your two-step codes, or your payment gateway credentials. A good developer won't ask for any of them.

1. The owner email and password. Shopify's security guidance says not to share login credentials with anyone, and notes that Shopify Support doesn't ask for your password either.
2. OTPs, authenticator codes and recovery codes. Forwarding a login code is the same as sharing the password.
3. Payment gateway dashboard logins and API secrets. If a gateway needs connecting, do it yourself on a screen share. Some gateway apps expect the owner to do this step anyway: Razorpay's own Shopify guide says to log in with owner credentials to connect Razorpay Secure.
4. Your business email login. Whoever controls that inbox can reset your Shopify password.
5. A full customer export over chat or email, unless the job truly needs it and you've agreed how it will be stored and deleted.

If someone you hired insists they need the owner login "to save time", treat it as a red flag.

What if the developer is building a new store for you?

Then the store should end up owned by you, with your billing details, from launch day. There are two clean ways to get there.

The developer can build in a store you've already opened, with collaborator access. Or they can build in a client transfer store from their Shopify Dev Dashboard and transfer ownership to you when it's ready. Shopify's docs say the developer keeps collaborator access by default after the transfer, so they can keep working on it.

What you want to avoid is a store sitting in someone else's account months after launch. Before the final payment, check Settings > Users and confirm that your name is on it as store owner.

How do you remove a collaborator when the job ends?

Remove them the day the final handover is signed off. Go to Settings > Users, open Users or Users & permissions, click the collaborator's name, then click Remove in the Remove collaborator account section and confirm. Organization stores use Actions > Remove instead.

Three things to know:

• Removal is permanent. If you need the same developer next month, they send a fresh request. That's a feature: every engagement starts with a deliberate yes.
• Their name stays in your activity log and order timelines, so you still have a record of what they changed.
• Shopify expires a collaborator automatically after 90 days without a login. That's a safety net, not a plan. A developer who logs in once a month stays active forever.

While you're on that page, remove anyone else you don't recognise, and check any apps the developer installed. Uninstall the ones you're not using. Old apps keep their data access, and they often slow the store down too, which I cover in why Shopify apps slow your store.

For ongoing work, a retainer is the cleaner setup: one named collaborator with a stable role, reviewed every quarter. That's how I run maintenance retainers.

What I'd do

When a new client says yes, the first thing I ask for is their collaborator request code, nothing else. I send a request with permissions matched to the job, and I tell the client which ones I've asked for and why before they approve it. For theme work I also ask for a GitHub repository they own, connected to an unpublished duplicate of their theme, so every change has a history and nothing touches the live theme until we agree.

A migration is the widest access I ever ask for. On Mum & You's move from Magento to Shopify Plus, the work included a full redirect map and rebuilt subscriptions, and that kind of job touches products, customers, apps and settings. Even then, the role covered the migration and nothing in finance or billing, and the access ended with the project.

If you've got a store that needs work and you'd like it done this way from day one, tell me about the project. If you're comparing options first, my hire a Shopify developer page explains how I work, and the rates page lists what it costs.

Related reads

• Freelance Shopify developer vs agency vs marketplace
• Hire an offshore Shopify developer: the vetting process
• Shopify maintenance and retainers: what they cover and cost

Sources

• Shopify Help Center: Collaborator accounts
• Shopify Help Center: Maximum number of users for each pricing plan
• Shopify Help Center: Store permissions
• Shopify Help Center: Two-step authentication
• Shopify Help Center: Account security best practices
• Shopify.dev: Theme Access app
• Shopify.dev: Client transfer stores
• Shopify India pricing (staff accounts per plan)
• Razorpay: Shopify Razorpay Secure integration steps