Hi,
We have recently had an app developer request full collaborator or staff access to the store so they can update their app on the store. Is this normal? We have never seen this kind of request before. Apps always seem to auto-update normally so I’m just trying to find out if there is a good reason for the developer to be requesting this. Appreciate any help. Thank you
Hey @shopbuild I work on the development side with Shopify apps so I can give you a direct answer on this: no, this is not normal.
Shopify apps update automatically through the App Store. Developers push updates to their app and every store using it gets the new version without anyone needing store access. There is no legitimate reason for an app developer to need full collaborator or staff access just to update their app.
The only scenarios where a developer might need some level of store access are:
-
Custom theme integration work where the app needs manual code added to your theme (but they should tell you exactly what they need to add and you can do it yourself)
-
Debugging a store-specific issue where they need to see your setup to troubleshoot (but even then, limited access with a clear scope and time frame is standard, not full access)
Full collaborator or staff access gives them the ability to see your orders, customer data, financial information, and make changes to your store. That’s way more than any app developer should ever need.
I’d ask them specifically what they need the access for and what they plan to do.
If they can’t give you a clear, specific answer, don’t grant it.
Well, it’s true that the app is not updated automatically untill you press the Update button after opening the app. That say, if the app having a lot of reviews and it’s popular app then definitly grant them access.
Otherwise you can update it by yourself.
If this was helpful, then don’t forget to like it and mark as Solution.
Full collaborator/staff access isn’t needed just for updates. Only grant access if they need to do custom theme work or troubleshoot with limited scope. You can ask why they need it before approving.
Hey @shopbuild
Don’t grant full anything. Ask them exactly what they need to do and why. If it’s a real theme tweak or bug fix, set up a collaborator request (Settings > Users and permissions, turn on the request code option), approve only the matching permissions, and remove access when they’re done. If they can’t explain why a routine update needs hands in your store, that’s your answer.
Best,
Moeed
The part that gets overlooked is the cleanup after access is removed. A developer may only touch one theme file, but if there’s no note on which file or setting changed, the next theme update or app issue turns into guessing what was custom work and what was already there.
Yes, just as they mentioned in the comments section. Typically, full permissions are not required. If the dev requests permissions during an upgrade, it is usually because its scope has changed. In such cases, the store owner must click a button to authorize the application update.