MindLab Future AIDon't share your Shopify login. Give your virtual assistant their own account with only the permissions their tasks need: a staff account if they work in your store regularly, or a collaborator account if they have a Shopify Partner account and you want to approve access with a request code. Start with the narrowest access, widen it as trust and skill grow over the first month, and remove access the day the work ends.
Why not share your login
A shared login means you can't tell who changed what, you can't remove one person without changing everyone's password, and anyone with the login can reach customer data, payouts and settings. Shopify's own guidance is to give each person a separate account so you can set what they can view and do, and to turn on two-step authentication on your own account.
Staff account or collaborator account
Shopify's rules on seats and plans change. Check Settings, then Users in your admin and the Shopify Help Center page on managing staff for your current limits before you plan around a number.
- Staff account. Best for a VA or team member who works in your store regularly. You invite them by email and choose their permissions. Staff accounts count toward the staff limit of your plan, and the limit depends on your plan.
- Collaborator account. Best for outside partners such as agencies and freelancers. The collaborator needs a Shopify Partner account (free to create) and sends an access request using a code from your admin; you approve it and choose what they can access. Collaborator accounts generally don't count toward your staff limit (confirm in the Help Center), which makes them useful when you have run out of seats.
If you cannot add more staff accounts, the collaborator route is usually the answer. If your VA doesn't want a Partner account, a staff account is simpler.
Which permissions to grant
Grant by task, not by title. The options below are examples, so match them to the permission names you see in Settings, then Users and permissions.
| VA task | Typical access | Keep off |
|---|---|---|
| Product listings and uploads | Products, collections, inventory | Orders, customers, settings, apps |
| Order processing and tracking | Orders, fulfillment | Payouts and financial reports, themes |
| Customer support | Orders and customers (view), draft orders if needed | Product editing, settings |
| Page and content updates | Content or online store pages | Orders, customers, payments |
Keep these for the owner only: billing, payments settings, user management, app installs, and domain or theme code changes. Ask every account to turn on two-step authentication.
A 4-week access ramp
Many VA guides recommend easing in rather than granting everything on day one. This is a common pattern, not a Shopify rule:
Week 1: observe
Give the least access that still lets the VA see the work, such as view-only where Shopify offers it, and have them do tasks on a few items you review.
Week 2: one task area
Grant edit access to one area, such as products, and check a sample of their changes each day.
Week 3: add a second area
Add orders or customer messages once the first area is running without corrections.
Week 4: review and settle
Cut any permission they haven't used, write down the final scope, and move from daily to weekly checks.
Offboarding checklist
- Remove the staff account or end the collaborator access the day the work ends.
- Check which apps and integrations they connected, and disconnect any that only they used.
- Rotate any shared passwords or API keys they were given. Better, don't hand any out in the first place.
- Export or note any documents, SOPs and templates they built, so the knowledge stays with the store.
- Review the account list every quarter for people who no longer need access.
Onboarding checklist for a new VA
- Written scope: the tasks they own, and the ones they must not do.
- Process notes or short screen recordings for the 3 to 5 most repeated tasks. Our free SOP builder turns the common ones into a written SOP and checklist.
- Where to report: a daily or weekly status update with a fixed format.
- Escalation rules: what they should ask you before doing, such as refunds above a set amount, price changes or deleting products.
- Response times and working hours, including time zones.
- A trial task you can check before you widen access.
Know what changed, and undo it
Shopify has no one-click undo for a saved bulk edit or import that we could confirm, and visibility into who changed what varies by what you edit and which plan you are on. Two habits cover most of the risk: export your products before any bulk change, and review a sample of the VA's work. Our guide on undoing bulk edits and imports covers what you can and can't recover. We are researching better tooling for owners and VAs who work together, so tell us what you struggle with.
FAQ
Should I give my Shopify virtual assistant my login?
No. Give them their own staff or collaborator account with only the permissions they need. A shared login can't show who changed what, can't be revoked for one person, and exposes customer data and settings.
What is the difference between a Shopify staff account and a collaborator account?
A staff account is for people who work in your store regularly and counts toward your plan's staff limit. A collaborator account is for outside partners with a free Shopify Partner account; you approve their request with a code from your admin. Collaborator accounts generally don't count toward the staff limit; confirm in the Help Center.
What if my Shopify plan has no spare staff accounts?
Use a collaborator account if your VA can create a Shopify Partner account, remove staff who no longer need access, or check whether a plan change makes sense. Confirm current limits in the Shopify Help Center, since they depend on your plan.
What permissions does a Shopify VA need?
Only those for their tasks, for example products and inventory for listings, or orders and fulfillment for order processing. Keep billing, payments, user management, app installs and theme code with the owner.
How do I remove a VA's access when they leave?
Remove their staff account or end the collaborator access, disconnect any apps only they used, and rotate any shared passwords or keys. Review the account list regularly.
Want a hand with your Shopify store?
We build and fix Shopify stores, imports and integrations. Tell us what you are working on and we'll reply within 24 hours.
This guide is general information, not legal or security advice. Shopify's admin screens, limits and plan rules change, so confirm details in the Shopify Help Center. MindLab Future AI is not affiliated with Shopify.