Shopify Agency Access: Managing Dozens of Client Stores

Monday, 9:40am. Your account manager needs to fix a broken shipping rate on a client's Shopify store before their sale goes live at noon. She opens the agency's shared Chrome window. It's still signed into a different client's Google account from Friday, the Klaviyo tab belongs to a third client, and Shopify wants a verification code that goes to the phone of someone who left the agency in March.

Nothing's broken. But for a Shopify agency, that browser window is a liability.

That's the real problem every Shopify agency running 20, 40, 80 client stores has. It isn't Shopify "catching" you for working across many stores. It's access sprawl: shared logins, sessions bleeding from one client into another, and no clean record of who touched what.

Agencies sometimes reach for disguise here — a different-looking device and network for every client login. That gets the job backwards twice over. Shopify is built for one person to work across many stores, so there's nothing to hide from it in the first place. And the merchant who hired you wants to see exactly who touched their orders page, not an operator who shows up looking like six different strangers.

We build JustBrowser, an antidetect browser, so we've got an obvious interest here. We'll be specific about where it helps and where it doesn't.

Shopify already expects one person to work across many stores

Collaborator accounts. If your agency is a Shopify Partner, you request access to a client's store from the Stores page in your Dev Dashboard (dev.shopify.com). The merchant approves the request and chooses which permissions you get: products, orders, themes, apps, whatever the job needs. Usually the merchant first gives you their 4-digit collaborator request code (they find it under Settings > Users > Security). The exception is when your organization already has an app installed on their store. Either way, nothing happens until the merchant approves the request. And per Shopify's help center at the time of writing, collaborator accounts don't count toward the store's staff-account limit (check the current help article, since plan details change).

One login, many stores. Each person's Shopify login can hold access to many stores, and you switch between them from the admin. One operator with access to 40 client stores isn't an anomaly. It's how partners are meant to work.

Staff accounts. For freelancers or in-house people who aren't working through your partner organization, the merchant adds them as staff with their own login and permissions.

So the question isn't "how do we stop Shopify noticing that one person logs into 40 stores?" Shopify knows. It gave you the access. The question is how to run that access so it stays secure, auditable and easy to hand over.

Why Shopify asks you to verify (and sometimes locks access)

Honestly? Shopify doesn't publish how its login security makes decisions, and we won't pretend to know. Anyone selling you a list of "exactly what Shopify checks" is guessing. Which is genuinely annoying — the one thing every agency ops lead would pay for is a published rule, and no platform gives you one.

What we can say is how account-security systems generally behave across the big platforms. They tend to step in when something about a login looks unlike the account's usual pattern:

a device or browser the account hasn't used before
cookies cleared, so every login looks like a first visit
a login from an unfamiliar country, or an IP that jumps around because of a VPN or proxy
several failed password attempts
one login being used by different people in different cities on the same day
a recent password or email change

Notice the pattern? Almost every item on that list is what a shared or a disguised login looks like from the inside. So the disguise approach manufactures the exact signals it's meant to dodge. Whereas a person logging in as themselves, from their own laptop, on the network they use every day, with two-step authentication on a phone in their own pocket, looks boring.

Boring is the goal. It's also a harder sell than a clever trick, which is roughly why the clever tricks keep circulating.

If access does get locked:

Complete whatever verification Shopify offers first. Often that's the whole incident.
Contact Shopify Support. If you're a partner, go through the support options in your Partner Dashboard, and explain plainly that you're an agency with approved collaborator access to that store.
Ask the merchant to check your access under Settings > Users. They can see your account and re-send or adjust access if something's wrong.
Don't create a new account to get around a restriction on an existing one. If Shopify has restricted an account, the way back is through Support, not a workaround. Shopify's Acceptable Use Policy says plainly that it doesn't want people gaming its systems to avoid constraints (check its current terms), and a workaround puts the client relationship at risk too.

Keep a short written access register: who has which access to which client, since when. If Support or a client asks, you'll have answers. And the waiting is the part nobody warns you about — a verification loop on a Friday afternoon, while the client's sale copy is already scheduled, is a special kind of helpless.

The real Shopify agency problem: client sessions bleeding into each other

Shopify admin is only one tab. A typical client engagement also means that client's Google account (for Merchant Center or the Google & YouTube channel), their Meta Business portfolio, their email platform, their reviews app, maybe a 3PL portal.

When all of that lives in one browser, mix-ups happen:

You connect the Google & YouTube channel while the browser is signed into the wrong client's Google account.
A Meta pixel or catalog gets linked to the wrong Business portfolio.
Your password manager autofills Client A's credentials on Client B's login page.
An SEO or page-speed extension you installed for one client can read pages in every store you open.
Exports and invoices from six clients pile up in one Downloads folder.

None of this is about Shopify enforcement. It's confidentiality and client trust, and it gets worse with every client you add.

Chrome profiles: honestly fine, up to a point

Plain Chrome profiles separate cookies, logins, extensions and history. For a three-person agency with ten clients, one Chrome profile per client may be all you need. Seriously. If that's working, keep it.

Chrome's profile picker does become a mess somewhere past a dozen — twelve near-identical circles with the same stock avatar, and you pick the wrong one at least once a week. Annoying, not disqualifying.

Where it starts to strain (in our view, somewhere past a handful of people sharing a client book):

Profiles live on one machine. When someone's off sick, their client's setup is stuck on their laptop.
There's no way to share a profile with a teammate at view-only or launch level.
You can't route one profile through a different region to check a client's international storefront.
Automating repetitive storefront checks across 40 clients is painful.

That's the gap a profile-management tool fills. Not "invisibility." Organization.

Where an antidetect browser fits (and where it doesn't)

"Antidetect" is the name of the product category, and we're keeping it. But for agency work on Shopify the useful parts are the boring ones. Our view, plainly: for this job it's an organisation tool. Anyone selling you one as insurance against Shopify is selling you something else.

One profile per client, per person. Each profile holds that client's admin, Google, Meta and email-tool sessions and nothing else, logged in with your own collaborator or staff account. Name them consistently ("C14 · Acme · Priya") and the 9:40am scramble goes away. Internal nicknames feel fun for a month and are unreadable to anyone who joins after that.

Team sharing with permissions. JustBrowser has owner, admin, member and viewer roles, and a direct share carries view-only or launch permission. A synced profile runs on one device at a time. One rule matters more than the feature list, though: share profiles for work that doesn't depend on one person's Shopify login (storefront QA, research, tools the client has granted to your team). Never pass around a profile holding a colleague's logged-in Shopify session. Each person logs into Shopify as themselves.

A gap we should own, since it's relevant to the register above: JustBrowser has no activity log. We built the sharing roles and never built the "who launched what, when" view to go with them, so your access register still lives in a spreadsheet.

Storefront QA across markets. If a client sells internationally, the storefront a shopper sees can change with their location: currency, language, prices, which products show. Checking that properly means a logged-out profile routed through the country you're testing, with matching timezone and locale. JustBrowser does per-profile proxy routing (HTTP, HTTPS or SOCKS5) and per-profile DNS-over-HTTPS. It doesn't include proxies, so you bring your own. Keep these profiles logged out of the admin.

Automation. The local REST API and CDP let you drive profiles from Playwright, Puppeteer or Selenium, which is handy for screenshotting storefront checks across clients and markets. The API runs on your own machine (it's documented at justbrowser.app/docs). For anything inside a client's admin data, though, use Shopify's own Admin API through an app the merchant approves. That's the sanctioned path, and it leaves the merchant in control.

Offboarding. When an engagement ends, export what you need (encrypted exports use AES-256-GCM with a passphrase), delete the client's profiles, and ask the merchant to remove your collaborator access. Clean exits get referrals.

What it won't do: fix a shared login, make a lockout go away, or stand in for the access Shopify gives you. If you want a deeper look at what antidetect browsers actually change under the hood, see how browser fingerprinting works, and our antidetect browser myths post covers what they can and can't do.

A per-client setup that holds up

The SOP we'd hand a new account manager on day one:

Request collaborator access from the Dev Dashboard, using the merchant's request code (unless your organization already has an app on their store) and asking only for the permissions the job needs.
One login per person. Everyone on the account has their own Shopify access. No shared passwords in Slack. Ever.
Two-step authentication on every account, using an authenticator app on that person's own phone, not a shared number.
One browser profile per client per person, named the same way across the team.
Log in from your real network. No VPN or proxy on profiles that touch a client's admin.
Separate, logged-out QA profiles for each market you test.
An access register listing person, client, access type and start date, reviewed monthly. If it lives in someone's head, you don't have one.
An offboarding checklist for both directions: a client leaving and an employee leaving. Revoking an ex-employee's access within a day is the single biggest security win most agencies are missing.

A bit of overhead, yes. Less than explaining to a client why someone who left eight months ago could still open their orders page.

And while we're being blunt: shared logins are the worst habit in agency ops, and they're almost always defended with "it's just easier". They are easier, right up until the week they aren't.

How many Shopify client stores can one person manage?

We don't have a number for you, and we'd be suspicious of anyone who does. Shopify doesn't publish a cap on how many stores a collaborator can access, and we don't have data on agency operators that would let us quote a ceiling.

The real limit is human: switching between 30 brands' themes, apps and discount rules wears people out long before any software limit does. Agencies that grow past that point usually split the client book: each account manager owns a subset, with written handover notes rather than shared logins. Our FAQ for teams and agencies goes into seats, permissions and onboarding in more depth.

Tools: JustBrowser vs Multilogin vs GoLogin vs AdsPower

All four can give each client its own profile. Multilogin, GoLogin and AdsPower generally price by profile tiers and per-seat add-ons, which adds up at agency scale; check their current pricing pages, or our dated comparison at justbrowser.app.

JustBrowser is what we built: a custom Chromium engine with native C++ integration (not an extension), patched on every upstream Chromium release, with 40+ identity parameters. $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

The seat detail matters for agencies. A seat is free but limited by design: it runs only the profiles shared with it. It can't create or sync its own profiles, and it has no API access. Anyone who needs their own profiles needs their own subscription.

Honest fit: agencies whose team works on Windows x64 or Apple Silicon Macs and wants shared, permissioned profiles without a per-seat bill. No Linux build, no mobile app. If half your team runs Linux, we're the wrong answer — better you hear it here than after paying. And if your current tool is working, don't switch mid-engagement just because we said so.

If the agency also buys traffic for clients, bot clicks on those campaigns are a separate problem that ClickzProtect is built for. And for cookieless analytics and error tracking across the sites you run, there's JustAnalytics.

Frequently Asked Questions

Can one agency employee work across dozens of client Shopify stores?

Yes. That's what collaborator accounts are for. A Shopify Partner requests access to a client's store from the Stores page in their Dev Dashboard (dev.shopify.com), the merchant approves it and picks the permissions, and the same person can then move between every store they've been given access to under one Shopify login. One person in many stores is the product working as designed, not a red flag.

Shopify doesn't publish how its login security decides, so treat any specific list with suspicion. Account-security systems generally react to things like a new device, cleared cookies, a login from an unfamiliar country or a VPN, repeated failed passwords, or one login being used by several people in different places. If access is locked, complete the verification Shopify offers, contact Shopify Support (through the Partner Dashboard if you're a partner), and ask the merchant to check your access under Settings > Users. Don't open a fresh account to get around a restriction.

No. Shopify's model is one login per person, which is why staff and collaborator accounts exist. A shared login breaks two-step authentication, wipes out the client's record of who changed what, and keeps working for anyone who leaves your agency. Give every person their own access and remove it when they move off the account.

Do I need an antidetect browser to manage client Shopify stores?

Not to stay in good standing with Shopify. Shopify already expects agencies to work across many stores. A tool like JustBrowser helps with a different problem: keeping each client's admin, Google, Meta and email-tool sessions in their own profile, sharing the right profiles with teammates, and checking how a client's storefront looks in other countries. A small agency can get a long way with plain Chrome profiles.

Should we use proxies when logging into client Shopify admins?

No. Log into client admins from your real network and location. Routing a login through a proxy in the client's country makes it look like you're somewhere you're not, which is a misrepresentation and the kind of mismatch that tends to trigger verification. Proxies belong on logged-out storefront QA profiles, where you're checking what a shopper in another market sees.

Try JustBrowser

Native Chromium antidetect browser — not extension-based. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer. Per-client profiles, permissioned team sharing, and a local REST API for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats.

Get started → · How it differs from Multilogin / GoLogin / AdsPower