Outsourcing marketplace operations often requires giving another company access to seller accounts, ecommerce platforms, catalogues or advertising assets. The operational benefit is real, but access should be designed around the work being performed rather than handled by sharing the owner's login.
A safe access model gives each person or partner only the permissions required for the agreed responsibilities, keeps ownership with the brand, and makes offboarding straightforward.
Keep account ownership with the brand
The brand should retain the primary owner or administrator relationship for its core ecommerce and marketplace accounts wherever the platform structure allows it. An external operator should work through delegated access rather than becoming the only person who can control the account.
This reduces continuity risk if the agency, employee or service provider changes.
Map tasks to permissions before granting access
Start with the actual job. A catalogue operator may need product editing but not finance. A customer-service user may need order and message access but not advertising controls. A campaign operator may need promotional tools but not the ability to change payout settings.
The principle is least privilege: enough access to perform the task, but no broader access simply because it is easier to grant.
Use named users or partner access instead of shared credentials
Shared logins make it difficult to know who changed a listing, price or setting. They also make offboarding harder because changing one password can disrupt several legitimate users.
Use platform-supported user, collaborator or partner access where available. Shopify currently supports user roles and collaborator accounts, while TikTok Business Center supports member and partner access with role and asset-level permissions.
Understand Shopify collaborator access
Shopify describes a collaborator as an external Shopify Partner who can work on a merchant store without being a staff member. The merchant controls the permissions granted to the collaborator and can remove access when the work ends.
Shopify's current guidance also requires collaborators to use two-step authentication. For projects involving an eligible Shopify Partner, this is generally more controllable than sharing the store owner's credentials.
Understand TikTok Business Center permissions
TikTok Business Center separates basic roles such as Admin and Standard and then allows access to accounts and assets to be assigned. Its current documentation, updated in March 2026, describes asset-level controls across resources including ad accounts, TikTok accounts, shops, pixels, catalogues and audiences.
An external operator should therefore receive the specific assets and permission level required for the agreed task rather than blanket access to the whole Business Center.
Create a permission matrix for the engagement
The access plan should be documented alongside the service scope. This makes approval easier and prevents operational changes from silently expanding account access.
Separate approval authority from execution
An external partner can perform routine operational actions while the brand retains approval over sensitive decisions. Examples include final pricing, discount strategy, product claims, refunds above an agreed threshold, payment settings and new user access.
This split protects the brand without forcing every routine catalogue edit through senior management.
Review access when the scope changes
Permissions granted at onboarding can become excessive over time. If an operator stops managing campaigns, the advertising access should not remain indefinitely. If a new marketplace is added, access should be approved as a new requirement rather than copied automatically.
A periodic access review can be tied to monthly or quarterly operating reviews.
Offboarding should be part of onboarding
Before granting access, define how it will be removed. Keep a record of every user, partner connection, API credential or app relationship created for the engagement.
When the relationship ends, remove user and partner access, rotate any credentials that were legitimately shared, revoke unnecessary tokens or app access where applicable, and confirm that the brand still controls the required operational records.
Keep an audit trail for sensitive changes
Where platforms provide activity history, use it to review changes to products, campaigns, users or other sensitive settings. Internally, require an approval record for high-impact actions even when the platform itself does not provide a detailed audit view.
This is especially useful when several internal and external teams work on the same seller account.
Apply the same discipline to marketplace operations
Stashworks' Ecommerce Enablement service can involve marketplace and platform access as part of the agreed setup. The brand should define the accounts, permissions and responsibilities required rather than providing unrestricted credentials by default.
The strongest arrangement is operationally convenient and reversible: the partner can do the work, the brand retains ownership, and permissions can be changed without disrupting the whole account.
Sources: Shopify Help Center, Roles; Shopify Help Center, Collaborator accounts; TikTok Business Center, Roles and permissions; TikTok Business Center, Account and asset-level permissions, updated March 2026; Stashworks, Ecommerce Enablement.
