When you hire someone to take orders or upload products, they need a login, but not the keys to everything. How to plan roles, set permissions and stay secure.
At some point you can't do everything alone. You hire a cousin to call customers, a part-timer to upload products, or a manager to run the shop while you source stock. The easiest shortcut, sharing your own password, is also the riskiest. One wrong click can delete products, change payment settings or expose customer data.
The safer approach is to give each person their own login with only the permissions they need.
How many staff accounts do you get?
According to the pricing page at the time of writing, the staff/user limit is 2 on Starter, 5 on Pro and unlimited on Elite, with role-based permissions on all plans. The Users & Access plugin is included in every package. Check the pricing page for the latest limits.
Users, roles and permissions in plain words
The Multipurc Learning Center explains it like this:
- Users are staff logins: one per person.
- Roles are groups of permissions, such as "manager".
- Permissions are single actions, such as creating a product (
product.create).
You build roles once, then assign a role to each user.
Step 1: Map the jobs in your business
Before touching settings, write down who does what. A typical small Bangladeshi store:
| Person | Job | Needs access to | |---|---|---| | Owner | Everything | Full admin | | Order handler | Confirm COD orders by phone, update status | Orders, customers (view) | | Product uploader | Add products, photos, prices | Catalog, media | | Packer | See what to pack, print invoices | Orders (view), invoices | | Manager | Daily operations | Orders, catalog, reports, couriers |
Notice that only the owner touches payment gateway settings, plugins, domain and staff management.
Step 2: Create roles
In the store admin:
- Open Users & Access → Roles. You'll see existing roles such as admin and manager.
- Click + New role.
- Enter a role slug using lowercase letters, numbers and hyphens, for example
order-handlerorproduct-uploader. - Tick the permissions this role needs. Permissions are grouped by area (for example address, analytics, attribute, blog and more), each with actions like create, view, update, delete and export. Use Toggle group to tick a whole section, or Select all / Clear.
- Scroll down and click Save.
Suggested permission sets
order-handler
- Orders: view, update
- Customers: view
- No delete, no export
product-uploader
- Products/catalog: view, create, update
- Attributes and categories: view
- Media: create
- No delete (so mistakes are recoverable)
packer
- Orders: view
- Invoices: view
Start narrow. It's easy to add a permission when someone asks; it's hard to undo damage.
Step 3: Add users
- Open Users & Access → Users.
- Click New user.
- Enter the person's details and choose their role.
- Share the login securely, in person or by a private message, never in a group chat.
Step 4: Security habits
- Never share the owner account. Each person gets their own login so you can see who did what.
- Don't give admin unless truly needed. The Learning Center makes the same point: avoid giving staff the owner or admin role.
- Remove access the day someone leaves. Use Edit or Delete in Users & Access → Users.
- Turn on two-step verification for your own account. The Learning Center has a guide on managing passwords, staff roles and two-step verification.
- Keep API keys private. Payment gateway and courier API keys should only be seen by the owner.
- Review roles every few months. People's jobs change; their permissions should too.
Special cases
Family members helping out
It's tempting to give family full access. Instead, give them a role that fits what they do. It protects them from accidental mistakes too.
Freelancers and agencies
If you hire someone to set up your store or design banners, give them a temporary role and remove it when the work is done. Agencies managing several client stores should read the Learning Center article on how agencies manage multiple client stores.
Shop counter staff using POS
If you use the POS plugin for in-store sales, counter staff need access to POS and products (view), not to settings or reports.
Signs your permissions are too loose
- Staff can delete products or orders.
- More than one person knows the owner password.
- A former employee's login still works.
- Anyone besides you can see payment gateway settings.
Summary
Map jobs to roles, give each person their own login, start with minimal permissions and review regularly. It takes about 20 minutes to set up, and it protects your store, your customers' data and your team.
Need more staff seats? Compare the limits on the pricing page.