A shared shop-floor or packing-station device should use individual staff accounts with short session timeouts, not one shared login. The convenience argument for a shared account is real and the cost is that no action can be traced to a person and no departure removes access, because there was never an account to remove.
What this person actually does
This is the one case in the cluster where the risk attaches to a location rather than to a role. Whatever the signed-in account can reach is reachable by anyone who walks up to the screen, including customers and delivery drivers.
The shared-login shortcut is genuinely tempting because individual logins on a busy counter are friction. But it removes both traceability and offboarding at once: a mis-fulfilment cannot be traced, and a leaver's access persists because it was never theirs.
The correct trade is narrow permissions plus short sessions. If the account can only do the few things the counter needs, the consequence of it being left signed in is much smaller.
The two layers
Shopify permissions decide what they can do in the admin. The Store Huddle role decides what they see in the workspace. Both are needed, and they are set separately.
| Layer | For this person | Why |
|---|---|---|
| Shopify staff account | Individual, per person | A shared login has no audit trail |
| Shopify permissions | The narrowest set the station needs | Usually orders and fulfilment only |
| Session | Short timeout, sign out between shifts | The device is unattended more than you think |
| Store Huddle role | Fulfillment, or a custom counter role | One or two rooms |
| Physical | Screen not visible to customers | Order and customer data is on it |
Shopify access to grant
Grant to the station's actual function, which is narrower than a person's. Shopify's permission labels change from time to time, so these are described by what they control rather than quoted as exact checkbox names. Check the current names in your own admin.
- Orders and fulfilment, which is usually the entire requirement.
- Inventory, where the station is also used for receiving.
- Individual accounts, even though the device is shared. This is the whole point.
- A short session timeout, shorter than you would set on a personal machine.
Access to withhold, and why
- Customer records, unless the counter genuinely serves customers who ask about their history.
- Finance and reports. Nothing at a packing bench needs revenue data on screen.
- Settings, apps and staff management, always.
- Any saved password in the browser, which converts a short session into a permanent one.
Rooms they belong in
One or two rooms. A shared device showing the full workspace is a privacy problem as much as a security one.
- The room for the station's function, usually fulfilment.
- A room for asking questions.
- Not direct messages, if the device is genuinely shared, since another person's DMs are not for the counter.
- Not management or finance rooms.
Offboarding
The commonest failure here is not a leaver's account but a browser left signed in. Check shared devices specifically when anyone leaves, because there is no account removal that covers it.
Audit the device itself periodically: what is signed in, what is saved, and whether the session timeout is what you set.
If a shared login already exists, replace it before doing anything else. Everything else in this page is ineffective while one exists.
Common questions
Should shop-floor staff share one Shopify login?
No. A shared login removes any ability to trace an action to a person and means access survives anyone leaving, because there was never an individual account to remove.
What permissions should a counter or packing device have?
The narrowest set the station's function needs, usually orders and fulfilment, plus inventory if it is also used for receiving.
What is the biggest risk with a shared device?
A browser left signed in. No account removal covers it, so shared devices need checking specifically whenever somebody leaves.
How short should the session timeout be?
Shorter than on a personal machine. The device is unattended more often than people assume, and it usually sits where customers can reach it.