How to Set Up Two‑Factor Authentication and Staff Permissions on Shopify Before Hiring Help

Direct answer: Before you sign a contract with an agency, enable two‑factor authentication (2FA) on your Shopify owner account and create staff accounts with only the permissions the agency needs. This protects your store, limits accidental changes, and makes it easy to revoke access later.

Referral disclosure: Nextpath Solutions may receive a referral fee if you create a Shopify account through these links.

Start your Shopify store

Why security matters at the pre‑launch stage

When a store is still in development, the owner typically has full admin rights. Giving the same level of access to a freelancer or agency creates two risks:

• Accidental changes: An inexperienced developer might delete a theme file or change tax settings.
• Account takeover: If the owner’s password is compromised, the whole store – including payment credentials – is exposed.

Shopify offers built‑in tools that cost nothing but dramatically reduce these risks. Setting them up takes under 15 minutes and requires only an email address and a mobile device.

Step 1 – Enable Two‑Factor Authentication for the Owner Account

1. Log in to Shopify. You must be on a paid plan (Basic Shopify or higher) because the free trial does not support staff accounts.
2. Go to Settings → Users and permissions. Your own account appears at the top.
3. Click “Set up two‑factor authentication”. Choose either an authentication app (Google Authenticator, Authy) or SMS codes. Authentication apps are more reliable.
4. Scan the QR code with the app. The app will generate a 6‑digit code.
5. Enter the code in Shopify to confirm. Save the backup codes that Shopify shows – store them in a secure password manager.
6. Test the login. Log out, then log back in using your password and the 2FA code.

Cost: free. The only possible expense is a mobile data plan for receiving SMS, but an authentication app works offline.

Step 2 – Create Staff Accounts with Least‑Privilege Access

Shopify lets you add unlimited staff accounts on any paid plan. The key is to assign only the permissions the agency needs.

1. In Settings → Users and permissions, click “Add staff account”.
2. Enter the staff member’s name and email. Shopify will send an invitation.
3. Choose permissions. Common groups for agencies are:
• Online store – Themes (to edit theme code).
• Online store – Pages (to create content).
• Products (if the agency will upload or edit products).
• Apps (to install required integrations).
• Settings – Payments only if the agency is handling payment gateway configuration. Otherwise leave unchecked.
4. Avoid giving “Full access”. Full access includes Finance, Orders, and Settings, which most agencies do not need for a design or development project.
5. Require 2FA for staff. After the staff member accepts the invite, they will see the same 2FA prompt as the owner. This setting is mandatory for all staff on Shopify.
6. Document the permissions. Keep a simple spreadsheet (Google Sheet) listing each staff email, granted permissions, and the date added. This makes revocation easy when the project ends.

Cost: free. The only recurring cost is your regular Shopify subscription.

Step 3 – Verify Access and Record a Recovery Plan

Before the agency starts work, run a quick verification:

• Log out of your owner account.
• Log in with the new staff credentials (you can do this in a private browser window).
• Confirm that the staff member can reach only the sections you allowed.
• Attempt to access a restricted area (e.g., Settings → Payments). You should see a “You don’t have permission” message.

Finally, create a short recovery plan:

Explore Shopify

1. Store the owner’s backup codes in a password manager.
2. Note the date when each staff account was added.
3. Plan to remove staff access immediately after the agency’s contract ends or the specific task is completed.

Real‑world example: Ahmed’s store in Pakistan

Ahmed wants to launch a handmade‑jewelry store on Shopify. He plans to hire a freelance developer to customize his theme. Here’s how Ahmed follows the steps:

1. Prerequisite: Ahmed signs up for the Basic Shopify plan ($29 USD/month) because he needs staff accounts.
2. 2FA: He installs Authy, scans the QR code, saves the backup codes in LastPass.
3. Staff account: He adds “Ali – Theme Developer” with permissions for Themes and Pages only.
4. Verification: Using a private window, Ahmed logs in as Ali and confirms that the Payments settings are hidden.
5. Documentation: He creates a Google Sheet called “Shopify Access Log” with columns for Email, Permissions, Invite Date, and Revocation Date.
6. Project end: After the theme is live, Ahmed removes Ali’s staff account, revokes the invitation, and stores the revocation date in his sheet.

The total extra cost for security is $0, but Ahmed saves time and avoids the headache of accidental changes.

Common mistakes and how to fix them

• Giving every new staff member “Full access”. Fix: Review each permission box and uncheck anything not needed.
• Skipping backup codes. If you lose your phone, you’ll be locked out. Fix: Store the codes in a secure, separate location.
• Using the same password for the owner and staff accounts. Fix: Generate unique, strong passwords (use a password manager).
• Never removing staff after the project. Fix: Set a calendar reminder for the revocation date.
• Assuming 2FA is optional for staff. Shopify forces 2FA for all staff on paid plans, but if you disable it for a test account, you’ll lose the ability to log in later. Keep 2FA enabled.

Quick security checklist

1. Upgrade to a paid Shopify plan (Basic or higher).
2. Enable two‑factor authentication on the owner account.
3. Save backup codes in a password manager.
4. Add staff accounts for each external collaborator.
5. Assign only the permissions required for the task.
6. Verify staff access in a private browser window.
7. Document account details and permission sets.
8. Schedule a revocation date and remove access when the work is done.

Conclusion

Securing your Shopify store before you bring in an agency is a small upfront investment of time that protects your brand, your payment data, and your peace of mind. By enabling two‑factor authentication and configuring least‑privilege staff accounts, you keep control of critical settings while still allowing experts to do their job. Follow the checklist, keep records, and you’ll be ready to launch without fearing unwanted changes.

Get started with Shopify

FAQs

Do I need a paid Shopify plan to use staff accounts?

Yes. Staff accounts and required 2FA are available only on Basic Shopify or higher plans.

Can I require 2FA for a staff member who only needs to edit product descriptions?

Shopify enforces 2FA for every staff member on paid plans, so the answer is automatically “yes”. The extra step adds security without extra cost.

What if I lose my phone after setting up 2FA?

Use the backup codes you saved during setup. Store them in a secure password manager or a physical safe.