Collaborator request code

Collaborator request code: only Partners you share the code with can ask for access

Staff Access Audit Guard (Shopify App Store) is a Shopify app that reviews installed-app access and granted scopes, staff access records, and ownership evidence, without reading customer or order bodies. It does not set or rotate the collaborator request code, approve or deny collaborator requests, or remove users. Confirm live listing text rather than this page. This guide does not add prices.

Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.

Free check first: App access scope reader runs in your browser and sends nothing. Paste an app's access scopes and see which touch customer data or can write.

What the collaborator request code is

The request code is a native Admin control. Shopify’s Help Center Collaborator accounts documents that you must give the Partner a request code, and the Partner must enter that code when they submit a collaborator request. Only the Partners you share the code with can ask for access.

  1. Open Settings → Users (or Users & permissions on a store that is not in an organization).
  2. Open Security.
  3. In the Collaborators section, copy the 4-digit code and send it only to the Partner you expect.

You still accept or reject each request on the Users index (filter by Requests). The code only gates who can send the request. It does not grant access by itself.

If requests stay open, any Partner who knows the store URL can ask

If the store still allows open collaborator requests — the Security preference that lets anyone send a request, sometimes labeled Anyone can send a collaborator request — any Shopify Partner who knows the .myshopify.com URL can submit a request. You still have to approve it. The cost is inbox noise and a higher chance that a request that looks “official” is accepted by mistake.

Prefer Only people with a collaborator request code. Share the code with the Partner you hired. Do not post it in a public ticket, a theme comment, or a screenshot.

Install Staff Access Audit Guard

Write a review

Rotate the code when a relationship ends or the code may have leaked

Help Center documents Generate new code in the same Collaborators Security section. After you generate a new code, old codes stop working. Use that when a Partner job ends, when a code may have been forwarded, or when you need a Partner to re-request after you removed their collaborator account.

  1. Open Settings → Users → Security.
  2. In Collaborators, choose Generate new code.
  3. Share the new code only with the next Partner you actually want a request from.

Generating a new code does not remove people who already have access. It only stops new requests that still use the old code.

Request hygiene: store URL, least privilege, then Remove

Partners should request access with the store’s .myshopify.com URL, not the custom domain. A custom domain is for shoppers. Collaborator requests look up the Admin store.

When you approve a request, grant the least privilege the job needs. Help Center tells you to review the auto-generated role and the permissions the Partner asked for before you accept. You can reject a request you do not recognize.

Collaborators are not staff. Staff Suspend does not apply. When the work ends, use Remove collaborator account — that path is the sibling guide Cannot suspend a Shopify collaborator — remove access instead. After Remove, they must send a new request, and they need the current code.

Install Staff Access Audit Guard

After the code and approvals are set: audit who still has access

Locking the request code and approving least-privilege collaborators is native Settings → Users work. Staff Access Audit Guard does not replace the Security code toggle. After those Admin steps, run an access and scope audit so remaining staff, other collaborators, and installed apps with customer-data scopes are still inventoried. The listing’s job is a recurring review of access you already granted — not generating or rotating the request code, and not approving or denying Partner requests.

  1. Open the Staff Access Audit Guard listing (apps.shopify.com/momiji-access-audit) and install it on the store you just locked down.
  2. Wait for the first audit on install, or run another now.
  3. Review staff and collaborator reminders, and apps that can touch customer or order data.

The app scores and flags access. It does not set the request code, approve collaborator requests, or remove users. Confirm live listing text rather than this page.

Install Staff Access Audit Guard

What this page is not

Install Staff Access Audit Guard

Related pages

Not a security attestation. Not employee monitoring. Native Settings → Users → Security is the request-code control. The app scores and flags access you already granted; it does not rotate the code or block Partner requests.