A Shopify collaborator account is how a Shopify Partner, such as an agency or freelancer, gets into your store without your password. You copy a 4-digit request code from Settings > Users > Security and send it to the agency. The agency sends a request with that code, and you approve it with only the permissions the job needs. Collaborators do not use one of your staff seats, and you can remove them at any time.
We are a Shopify and Shopify Plus agency based in Dubai, and we ask clients for collaborator access at the start of most projects, so this is the process we walk owners through. Everything below was checked against the Shopify Help Center in November 2026; if a label looks different in your admin, the linked page is the reference.
Key takeaways
- Never share the owner login. Shopify’s own security advice is not to share your login credentials with anyone. A collaborator account gives an agency its own login that you control.
- The 4-digit code is your gate. Only Partners who have your code can send a request, and you can generate a new code at any time.
- Collaborators do not count toward your user limit. That matters most on Basic and Starter, where the staff limit is zero.
- Give permissions by job, not by trust. A theme developer does not need orders, customers or payment settings.
- Remove access when the project ends. Access also expires after 90 days without a login, but that is a safety net, not a plan.
What is the difference between a collaborator account and a staff account?
Both give someone their own login to your Shopify admin with permissions you choose. Staff accounts are for your own team: you invite them by email, and the invitation expires after 7 days. Collaborator accounts are for Shopify Partners, who start the request themselves using your code. Shopify’s collaborator accounts page sets out the rules that apply only to collaborators.
| Question | Staff account | Collaborator account |
|---|---|---|
| Who is it for? | Your employees and in-house contractors | Shopify Partners: agencies, freelancers and developers |
| Who starts it? | You, by inviting an email address | The Partner, by sending a request with your 4-digit code |
| Does it use a seat on your plan? | Yes | No, collaborators do not count toward the user limit |
| Two-step authentication | Required by default for new users, and you can change it per user | The Partner must turn it on or cannot log in |
| Can it get the Administrator role? | Yes | No |
| Point of Sale access | Possible, with POS roles | No access to the POS app or the Point of Sale channel |
| Store ownership transfer | Possible, from Settings > Users | Not possible to a collaborator |
| Expiry | No automatic expiry | Expires after 90 days without a login, and you can reactivate it |
Does a collaborator use a staff seat?
No. Shopify’s user limits by plan list collaborators among the user types that do not count toward your total, alongside the store owner and POS-only staff. At the time of writing, the staff limits are:
- Starter and Basic: 0 staff accounts. The limit applies to staff accounts only, so you can still add collaborators.
- Grow: 5 users.
- Advanced: 15 users.
- Shopify Plus: unlimited users.
So on Basic there is no staff seat to give an agency, and sharing the owner login is never the answer.
What is the 4-digit collaborator request code?
Every store has a 4-digit collaborator request code. A Partner must enter it when they send a request, and only Partners you share it with can ask for access. Shopify’s current help page treats the code as required for every request, so the code itself is your control.
To find it:
- In your Shopify admin, go to Settings > Users.
- If your store is part of an organization, click Users. Otherwise, click Users & permissions.
- Click Security.
- Click the 4-digit code to copy it, and send it to the agency.
To change the code, go to the same Security page and click Generate new code in the Collaborators section. Old codes stop working straight away.
How do you approve a collaborator request and choose permissions?
On a single store, only the store owner and users with the Administrator role can see requests and grant access. Each request comes with an auto-generated role built from the permissions the Partner asked for. You can edit that role, or remove it and assign roles you already have. These steps follow Shopify’s current process:
- Agree the scope first. Before you send the code, agree in writing what the agency will do and which areas of the admin that needs.
- Send the code privately to the named person at the agency.
- Wait for the request. The agency sends it from its Partner account with your store URL and the code.
- Open the request. Go to Settings > Users, click the Requests status on the users list, and open the request.
- Check the Partner details. Requests can show the Partner account’s age, active collaborations, signup country, request country and possible VPN use. Shopify says these do not confirm identity, so ask about anything unexpected before you accept.
- Review the permissions. In the Roles section, edit the auto-generated role, assign an existing role, or create a new one. Remove anything the job does not need.
- Accept or reject. Click Accept request, or Reject request to decline. Rejecting also removes the auto-generated role.
- Note an end date in your calendar, so you remember to remove access.
You can also limit a collaborator to specific apps and channels by assigning permissions for only those apps and channels.
Which permissions should you give for theme work, apps, CRO and SEO?
Collaborators can request any store permission, so the request you receive may ask for more than the job needs. Use Shopify’s store permissions list to check what each one does. Your agency should be able to explain every permission it asks for.
| Job | Usually needed | Add only if the job needs it | Usually not needed |
|---|---|---|---|
| Theme design and development | Online store: Themes and Edit code. Files: Create. Products: View. | Store settings: Manage settings, to customise themes for every market. Manage and install apps and channels, to install a theme from the Theme Store. | Orders, Customers, Finance, payment settings |
| App setup and integrations | Apps and channels: Manage and install apps and channels, plus the areas each app touches, such as Products or Orders. | App development permissions, only if they build a custom app inside your admin. | Approve app charges. Keep paid installs with the owner. |
| CRO and A/B testing | Online store: Themes. Analytics: Reports and Dashboards. | Discounts, for offer tests. Checkout and customer accounts: View and edit, for checkout work. Manage and install apps, for a testing tool. | Customers: Export, Orders: Refund to original payment method, payment settings |
| SEO | Online store: Themes and Blog posts and pages. Products: Create and edit. Analytics: Reports. | Store settings: Manage settings, which opens the Preferences page with the home page title and meta description. Edit code, for structured data in the theme. | Orders, Customers, Finance |
Two details catch owners out. Products: Create and edit does not include editing prices, which is a separate Edit price permission. And Analytics: Reports does not let you choose which reports a user sees.
Shopify marks some permissions as sensitive, including Customers: Request data and the permissions for billing and other payment settings. Its advice is to give these only to your most trusted users. An outside agency doing theme, CRO or SEO work should almost never need them. For payment projects, see our guide to Shopify payment gateways in the UAE, and give payment access for the shortest time you can.
How is it different on Shopify Plus with an organization?
Shopify Plus stores are usually managed in an organization, and that changes a few rules:
- Who can accept. Organization owners and users with the Organization administrator role can edit and accept the auto-generated role. Store owners, Store user administrators and Organization user administrators can assign existing roles only.
- What you cannot assign. Organization roles and the Store user administrator role cannot go to collaborators, and on Plus, collaborators cannot be added to groups.
- One account per store. A collaborator who asks for access to several stores in your organization gets a separate account for each approved store, all with the same name. You can bulk assign the same role, but one account cannot reach several stores.
- Two-step authentication for everyone. Plus organizations can set the secure sign-in method to Required for all users under Settings > Users > Security. This is only available on Plus.
If you run separate stores for the UAE, Saudi Arabia and other markets, give each agency the same limited role on every store. Our Shopify Plus development page covers how we work with organizations.
How do you remove a collaborator?
Removing a collaborator is permanent. If you want them back later, the Partner must send a new request.
- Go to Settings > Users, then click Users (organization) or Users & permissions (single store).
- To see every collaborator at once, filter the users list by User type > Collaborators.
- Click the collaborator’s name.
- In an organization, click Actions > Remove. On a single store, click Remove in the Remove collaborator account section.
- Confirm. The collaborator’s name stays in activity logs and order timelines, so you keep a record of what they did.
If a collaborator has not logged in for 90 days, Shopify expires their access automatically. You can bring it back from the user’s page with Actions > Reactivate user. Do not rely on it: an agency that logs in once a month keeps its access.
Security tips before, during and after a project
- Never share the owner login. Shopify’s account security best practices say not to share your login credentials with anyone, including staff. An agency that asks for your password instead of sending a collaborator request is a warning sign.
- Turn on two-step authentication for yourself. Collaborators must use it already. Protect your owner account with an authenticator app or security key. Shopify’s two-step authentication guide also shows how to require it for each staff member.
- Review access when a project ends. Filter by collaborators, remove anyone who has finished, and generate a new request code.
- Do not accept unexpected requests. If a request arrives from someone you do not recognise, reject it. Shopify has a form to report a Partner violation.
How to vet an agency before giving access
Before you send the code, ask:
- Which permissions do you need, and why? A good agency lists them by task and does not ask for payments or customer exports for a theme project.
- Who on your team will log in? You want named people, not “the team”.
- How will you change the live theme? The answer you want: work on a duplicate theme, preview it with you, then publish at an agreed time.
- Who owns the work? Theme code, custom apps and documentation should be yours when you have paid for them.
- What happens at the end? A professional agency will remind you to remove its access.
Our guides on what a Shopify agency costs in the UAE and agency engagement models cover the commercial side of the same decision.
When you do not need an agency (or a collaborator) at all
Not every change needs outside help. Swapping a banner, editing a page or changing theme colours in the theme editor is usually faster to do yourself. If a freelancer is not a Shopify Partner, they cannot send a collaborator request, so they would need a staff account, which uses one of your seats.
An agency is worth it when the work touches theme code, checkout, apps or search rankings, where a mistake costs sales. That is the work our conversion optimisation and SEO and performance teams do under a limited collaborator role.
FAQ
Where do I find my Shopify collaborator request code?
Settings > Users, then Users or Users & permissions, then Security. Click the 4-digit code to copy it.
Does a collaborator account cost anything or use a staff seat?
Collaborators do not count toward your plan’s user limit, so they do not use a staff seat, even on Basic or Starter where the staff limit is zero. Any cost is the agency’s fee, not a Shopify charge for the account.
Can a collaborator see my customers and orders?
Only if you give them those permissions. You choose every permission when you accept the request, and you can change the role later.
What if I rejected a request by mistake?
The Partner can contact Shopify Partner Support. If you removed an accepted collaborator by mistake, they need to send a new request with your current code.
Is the process different for stores in Dubai or the wider GCC?
No. Collaborator accounts work the same way in every country. The one local habit worth adding is a check of the request’s signup and request country against where your agency actually works.
If you are about to bring in an agency, we are happy to tell you which permissions a project really needs, even if you hire someone else. Get in touch, or start with a free speed audit of your store.
