Security, access and ownership
How to give an agency safe access to Seller Central, Seller Center and Shopify
Never share a password. Every platform has a way to give a named person limited access and take it back, and that is how to give an agency access to Seller Central, Walmart Seller Center and Shopify. Here is how each one works, and how we work inside it.
No owner passwords · MFA on every account · Access removed within 24 hours
Quick answer
On Amazon, authorize an agency through Amazon's service provider authorization rather than adding it as an employee: review the roles it asks for, restrict any you do not want and keep bank, tax and legal settings with you. On Walmart, add each person with the Read Only or Read and Write role and keep Admin yourself. On Shopify, accept a collaborator request. Never share your password.
How to give an agency access to Seller Central, step by step
Give an outside provider its own authorization, never an employee login and never your password. Amazon changed the provider route in 2026. Its developer documentation now describes a service provider authorization: the provider, registered in Amazon's Solution Provider Portal, sends you an authorization link, or you choose "Authorize Now" on its Service Provider Network listing. "The authorization is good for 365 days" (Amazon developer docs, how sellers authorize service providers). Trade press reports that Amazon retired the old provider invite on Aug 10, 2026 and is asking sellers to reauthorize existing providers (beBOLD Digital, 2026). Seller Central menus change, so check the notices in your own account first.
- Ask the agency for its authorization link, or find its listing in Amazon's Service Provider Network. Check that the name matches the company you signed with.
- Sign in to Seller Central yourself and open the link. Never let anyone else sign in for you.
- Read the roles the provider is asking for. Restrict any role the agreed work does not need.
- Keep bank, deposit and payout methods, tax settings, legal entity details, agreements and user management with you. No provider needs them.
- Confirm the authorization, and note the date: it runs for 365 days, so diary a review before it lapses.
- For your own employees only, add each person as a named user under Settings, then User Permissions, with only the sections their job needs.
Some guides tell you to give a provider Admin on every section. We do not ask for that, and you should not need to give it to anyone.
What we ask for, by service
| Service | Amazon permissions we request | Never |
|---|---|---|
| Profit Leak Scan | View only: reports, inventory, payments and account health | Edit rights of any kind |
| Store Care, Ops Desk, Full Relay | View and Edit on inventory, listings, orders and reports; pricing only within rules you approved | User management, bank, deposit, tax or legal entity settings |
| Amazon Ads (plans with ad management) | The lowest Advertising console role that fits, per person | Billing and payment settings |
Walmart Seller Center: step by step
Walmart has three roles, and an agency never needs the top one. Only an Admin can add users, so you do this step yourself.
- In Seller Center, open People and permissions (under Settings).
- Select Add User.
- Enter the person's name and email, and choose the role:
- Read Only for a scan: they can view data and create and download reports, but change nothing.
- Read and Write for monthly work: item setup, operational tasks and reports.
- Admin stays with you. Admins can accept binding legal agreements, create API keys, request special category approvals and add users.
- Select Add. Walmart emails the person a link to create their login.
Add one user per person, by name. A shared agency inbox as a single user hides who did what. To remove someone, delete them from People and permissions; Walmart's guide "Delete a user from my Seller Center account" has the current steps.
Shopify: collaborator access
Shopify's collaborator accounts are the approved way for an agency to work in your store. They do not use one of your staff seats.
- Optional but sensible: in Settings > Users (shown as Users and permissions on stores outside an organization), under Security, create a 4-digit collaborator request code and share it only with the agency. Only partners with the code can request access, and generating a new code cancels the old one.
- The agency sends a collaborator request from its partner account, one per named person.
- In Settings > Users, open the request. Review the permissions it asks for, remove any you are unsure about and ask why they are needed.
- Select Accept request.
Grant only what the work needs: orders, products and reports for a scan; more for monthly work, with your approval. Payouts, billing and store ownership stay with you. Shopify requires two-step authentication for collaborators, and a collaborator who has not logged in for 90 days loses access automatically (Shopify Help Center, checked Oct 20, 2026).
To remove a collaborator, open Settings > Users, select the person and remove the collaborator account. Shopify warns that removal cannot be undone; the agency would have to send a new request.
3PL, helpdesk and ad accounts
The same rule applies everywhere: one named user per person, at the lowest role that does the job.
- For a scan:
a read-only user in your 3PL portal and helpdesk, or a report export covering the last 90 days.
- For monthly work:
a named user per person in each tool's own user settings.
- Amazon Ads:
invite each person through the Advertising console's user management at the lowest role that fits, only on plans that include ad management. Ad budgets stay your decision.
How to remove access
-
Amazon:
Settings > User Permissions, find the provider or user, and remove them.
-
Walmart:
People and permissions, select the user and delete them.
-
Shopify:
Settings > Users, select the collaborator and remove them.
-
Other tools:
delete or deactivate the named user in the tool's user settings.
Removal should take you minutes, and you should never need our help to do it.
Our commitment is that we remove our own access within 24 hours of a team change or the end of the work, and confirm each removal to you in writing. For a Profit Leak Scan, we remove access on the day we send the report.
How we keep your account separate
-
Isolated environments.
Each client is worked in its own isolated environment on company-managed devices. Nobody logs in to two clients' seller accounts in the same session or browser profile.
-
Company-managed devices only,
with screen lock, current updates and disk encryption. No personal devices for client work.
-
Multi-factor authentication
on every login, tied to the person, not to a shared device or inbox.
-
Named users only.
No shared logins, and no credentials sent by email or chat. Team credentials live in a company-approved password manager.
-
Least privilege.
Only the permissions a role needs, and nothing touching bank, payout, tax or legal entity settings.
-
An access register.
Every grant, change and removal is recorded, and you can ask for the current list at any time. On monthly plans we review it with you at least every quarter.
Your account is worked only in its own environment, by named people, on devices we manage. These practices come from our Access and Security Policy, which forms part of every client agreement.
These rules apply in full to a Dedicated Ops Team: each person works on a company-managed device, with MFA on every account and named logins only, and their access is removed within 24 hours of any change.
What stays yours
Everything. Every account, listing, login, workflow, dashboard, SOP and report stays in your accounts and in your name.
- We never sell, rent, transfer or share a seller account.
- Automations are built in your own tools, so they keep running if we leave.
- We resell no software licenses. Apps sit in your name, on your bill.
- On Full Relay, the brand, the inventory and every supplier relationship are yours as well.
Documents we sign
-
Mutual NDA,
on request, before a scan or a first call.
-
included in every paid engagement.
-
Access and Security Policy,
part of every client agreement.
-
Security questionnaires,
completed on reasonable request.
We put our security commitments in writing before any access is granted.
We do not hold SOC 2 or ISO 27001 certification and will not claim it.
Where your data goes
Your data is used only to deliver the work you hired us for, under our Data Processing Addendum. It stays in your own accounts and in US-hosted systems wherever possible.
- Team members, some of whom work outside the United States, may access it remotely to do the work, always through isolated environments on company-managed devices.
- Exports carry only the fields needed, are stored encrypted and are deleted within 30 days after their purpose ends.
- After a scan, if you do not hire us, exports are deleted within 30 days and we confirm it in writing.
- When the work ends, data is returned or deleted within 30 days, at your choice.
- If an incident affects your data, we tell you within 24 hours of becoming aware of it.
Our subprocessor list is published with the DPA. See also our privacy policy.
See how we work in your accounts
Start with a read-only scan, or ask your access questions first. Before you hire anyone, read our guide to vetting a store provider.
Talk to an ops lead (free). A real person replies within one business hour, 9am to 6pm US Central, Monday to Friday. More: how we work and Amazon account health management.
Does it cost anything to give an agency access?
No. Adding users on Amazon, Walmart and Shopify is free, and Shopify collaborators do not use one of your staff seats. Our Profit Leak Scan is free too, and it uses read-only access that we remove on the day we deliver the report. You never pay to grant or remove access.
Should I give my agency my Amazon password?
No. Authorize the agency through Amazon's service provider authorization, review the roles it requests and restrict anything the work does not need. Guidance from Amazon staff in the Seller Forums tells sellers not to share passwords. A provider authorization can be removed in minutes and lapses after 365 days, while a shared password has to be changed everywhere it was used.
What permissions does an agency need?
Only what the work needs. For a scan, view-only access to reports, inventory, payments and account health. For monthly operations, edit rights on listings, inventory and orders, with pricing inside rules you approved. No agency needs bank, deposit, tax, legal or user-management permissions to run operations.
Which Amazon permissions should never be granted?
Bank and deposit methods, tax settings, agreements and addendums, global account settings, managing services and authorized partners, lending and financing settings and user management. Leave "Grant universal site admin access" unchecked. If a provider asks for any of these, ask them to explain why in writing.
Should my agency be an Admin on Walmart?
No. Keep Admin yourself, because Walmart Admins can accept binding legal agreements, create API keys and add users on your behalf. Give the agency's named people the Read Only role for a scan, or Read and Write for monthly work. Only you, as Admin, can add those users.
Can working with an agency link my account to other sellers?
It can, if the agency logs in to many sellers' accounts from shared logins, devices or browser profiles. We work each client in its own isolated environment on company-managed devices, use named users only and never open two sellers' accounts in the same session or browser profile.
How do I remove an agency's access?
In Settings > User Permissions on Amazon, People and permissions on Walmart and Settings > Users on Shopify. It takes minutes and needs no help from the agency. We also remove our own access within 24 hours of the end of the work and confirm it to you in writing.
Do you have SOC 2?
No, and we will not claim it. We sign NDAs and a Data Processing Addendum, follow a written Access and Security Policy, complete reasonable security questionnaires and use multi-factor authentication on every account. If your business requires a certification, tell us in the first session.
Sources6 sourcesLast checked Oct 20, 2026
- 01sellercentral.amazon.comAmazon Seller Forums post by Connor_Amazon, Amazon staff: do not share passwords; minimum permissions; "Don't add external third-party service providers or developers as users", use the Authorized Partners tab; some replies report the tab is missing; checked Oct 20, 2026Primary
- 02developer-docs.amazonAmazon developer docs: provider registered in Solution Provider Portal sends an authorization link or the seller chooses Authorize Now; seller reviews and restricts roles; "The authorization is good for 365 days"; checked Oct 20, 2026Primary
- 03bebolddigital.comtrade press: old provider invite retired Aug 10, 2026; reauthorization requested; checked Oct 20, 2026Vendor
- 04marketplacelearn.walmart.comroles Admin, Read and Write, Read Only; updated Jul 2, 2025; checked Oct 20, 2026Primary
- 05help.shopify.comrequest codes, two-step authentication required, 90-day expiry, removal; checked Oct 20, 2026Primary
- 06help.shopify.com"Asking a merchant for their password ... is prohibited"; checked Oct 20, 2026Primary