Users & roles

Most stores don’t have one person doing everything. The packer shouldn’t be able to refund an order; the stock keeper shouldn’t be able to rotate your payment keys. Users & roles (Settings → Users & roles) is where you decide who can do what.

The five roles

Role	For	Holds
Owner	You	Everything, including settings, integrations and billing.
Manager	Runs the shop day to day	All day-to-day work — orders, catalog, stock, CRM, content. No settings or integrations.
Orders staff	The order desk	Orders, courier booking, returns; read-only on catalog and stock.
Inventory staff	The stock room	Catalog and stock; can see orders but not act on them.
Custom	Anything else	Starts from the Orders preset — then you tailor it.

Owner is special. It’s the only role that can grant ownership, and it always holds every permission — you can’t edit it down. Every other role is a starting point you’re free to change.

Tailoring what a role can do

Open Manage roles, pick a role, and switch individual permissions on or off. Permissions are grouped the way the work is grouped:

Orders — view, change status, create manual orders, book courier, manage returns, approve a fraud hold, refund, mark COD remitted, export…
CRM — view customers, edit profiles, add notes, block, export…
Catalog & inventory — create/edit/archive products, manage categories and pricing, view and adjust stock…
Content — pages, homepage sections, publishing.
Settings & integrations — owner-only (see below).

Your edits are saved per store. Changing the Orders-staff role changes it for everyone who holds it, immediately.

Two permissions worth thinking about

Refund order — off for Orders staff by default. Turning it on means that person can move money. Deliberate choice, not an oversight.
Export customer phone numbers — off even for Manager by default. A phone list is the most portable thing in your business. Owner keeps it unless you decide otherwise.

Hiding a menu item is a courtesy — it stops honest mistakes. It is not security, because anyone can type a URL.

So the role is checked on the server as well. A staff member without settings.manage_staff who calls the staff API directly gets a 403, not a page.

Inviting someone

Invite staff → name, email, and the role they should hold.
They get an email with a link to set a password and sign in.
Until they sign in, they show as Invited. Use Resend invite if the mail didn’t arrive.

You can change someone’s role at any time — it takes effect on their next request, not their next login.

Disabling someone (rather than deleting) keeps their history intact — their name stays on the orders they packed — and immediately signs them out of every device.

Two-factor policy

The right rail shows how many of your staff actually have 2FA on, and lets you require it for everyone. Worth doing the moment more than one person has a key to the shop.

Devices & sessions

Open any staff member to see the devices they’re currently signed in on — browser, OS, rough location, when they were last active, and a masked IP (103.94.xx.xx — a session list never shows a full address).

You can revoke one device or sign them out everywhere. Useful when a phone is lost, or someone leaves.

A session is listed while it hasn’t been signed out and the sign-in is still inside the refresh-token lifetime (7 days by default). After that it’s dead anyway — they’d have to sign in again.