Shopify
Shopify Basic does not allow staff accounts
Shopify's staff accounts are the right way to give someone access to your store — but Basic and Starter plans allow zero of them. On those plans there is no native way to let an assistant in, which is why owners end up sharing the login and relaying 2FA codes.
Try Users (staff accounts) first
Where this works, it is better than anything we offer: each person gets their own login, their own 2FA and their own audit trail.
- What it is called
- Users (staff accounts), plus Collaborator accounts for Shopify Partners
- Where to find it
- Shopify admin → Settings → Users
- Limits
- Basic and Starter: 0 staff users. Grow: 5. Advanced: 15. Each person needs their own Shopify login and their own 2FA.
Where that runs out
If you are on Basic or Starter, staff accounts are not available to you at any number. Upgrading to Grow for one assistant is a real cost, and Collaborator accounts only apply to Shopify Partners, not to a VA you hired directly.
What Pair2FA does about it
1. Add the authenticator secret once
Scan the QR code Shopify shows during authenticator setup, or paste the Base32 key if it offers one. Shopify's documentation describes scanning only, so capture it at setup time.
2. It is encrypted before it is stored
AES-256-GCM at rest. The secret is never shown again unless someone with export permission explicitly asks for it and re-authenticates.
3. Grant only the people who need it
Viewers see the rotating six-digit code and nothing else. Access is per account, so someone working on one client never sees another. Revoking takes one click and is written to the audit log.
Shopify team access: common questions
Should I just upgrade to the Grow plan?
If you can justify it, yes — staff accounts give each person their own login, their own 2FA and their own audit trail, which is strictly better. The question is whether a single assistant justifies the plan jump. If it does, upgrade and skip this entirely.
What about Collaborator accounts?
Collaborator accounts are for Shopify Partners — agencies and developers with a Partner account. They do not cover a virtual assistant you hired directly, which is the common case for a small store.
Is sharing a login against Shopify's terms?
Shopify's documentation steers you to staff accounts and does not prohibit sharing outright in the way some platforms do. We still recommend staff accounts wherever your plan allows them. Pair2FA is for the case where your plan does not.
What Pair2FA is not. It is not end-to-end encrypted. Secrets are decrypted on our server to generate codes, so a server compromise is part of the threat model. It is built to replace codes forwarded over chat and photographed QR codes, not to replace a hardware security key or a platform's own access controls. Our security page sets out the full threat model.