Staff, roles and two-factor sign-in
Invite your team, give each person the right role, and protect every account with two-factor sign-in.
Roles
Everyone on your team has one role. You can only give someone a role up to your own.
- Staff
Day to day: orders, fulfilment, photos and review moderation.
- Manager
Staff, plus the catalogue, promotions, refunds and reports.
- Admin
Manager, plus settings and managing staff.
- Owner
Everything, including making other owners.
A Staff member can also have a job preset that narrows what they can do: Catalogue Assistant, Warehouse employee, Customer service, or Read-only. Each one lists what it permits.
Invite someone
You need an Admin or Owner role.
- 1
Open Users & roles
Go to Settings, then Users & roles.
AdminthenSettingsthenUsers & roles - 2
Send the invitation
Under Invite someone, enter their Email, pick a Role, and a Job preset if they're Staff. Choose Send invitation.
- 3
They accept it
They get an email with an Accept invitation button. It works once and lasts seven days. They create an account with their name and a password, and they're in. Someone who already has an account on your shop signs in first, then accepts.
Pending invitations lists invites that haven't been used. Choose Withdraw to cancel one.
To change someone's role, pick a new one in People with access. They're signed out, and get the new role when they sign back in. To take someone off the team, choose Remove, then Remove access. A shop always keeps at least one owner.
Turn on two-factor sign-in
Two-factor sign-in asks for a code from your phone as well as your password. Each person sets it up for themselves.
- 1
Open Your account
Choose your name at the top right of the admin, then Your account.
- 2
Scan the code
Choose Set up two-factor sign-in. Scan the code with an authenticator app, such as Google Authenticator, 1Password or Authy. Can't scan it? Choose Can't scan it? to type a key in instead.
- 3
Enter the six digits
Type the code your app shows into Six-digit code, and choose Turn on two-factor sign-in.
- 4
Save your recovery codes
You get 10 recovery codes, shown once. Write them down somewhere safe, tick that you have, and choose Done. You're signed out, and sign in again with your new code.
From then on, after your password you're asked for the 6-digit code. Lost your phone? Type one of your recovery codes in the same box. Each one works once.
Make it required
The owner can require two-factor sign-in for some or all of the team. A new shop already asks Managers and above to set it up within 14 days.
- 1
Open Second factor
Go to Settings, then Second factor.
AdminthenSettingsthenSecond factor - 2
Choose who and when
Under Who must use a second factor, choose Required from, such as Staff and above, and a Deadline. The table shows who has set it up.
- 3
Save it
Choose Save policy. Until the deadline, people who haven't set it up see a reminder. After it, they have to set it up before they can use the admin.
If someone loses their phone
They can sign in with a recovery code, then set up two-factor again from Your account. If they have no codes left, the owner can choose Remove in their Two-factor column on Users & roles. It happens straight away, with no confirmation, and signs them out.
Who changed what
Settings › Audit log records changes across the shop: who, what and when. Filter it by action, record or date, and choose Export CSV to keep a copy. Managers and above can see it.