Purpose #
This article explains how Shopstars manages access to client accounts across Shopify, advertising platforms, and analytics tools. It covers why access management matters, how permissions are granted, what roles are required, and how security is maintained. Clients should use this as the reference for securely providing Shopstars with the access needed to build, manage, and optimize their store.
Why Access Management Matters #
Shopstars requires access to client platforms to perform development, advertising, and analytics work. Improperly shared access (such as sending passwords via email) introduces security risks and complicates accountability. Using official access systems ensures that permissions are traceable, revocable, and aligned with the principle of least privilege—granting only what is necessary for the role.
Shopify Access #
Clients must add Shopstars as a staff account rather than sharing personal logins.
- Navigate to Settings > Users and Permissions > Add Staff.
- Provide full Admin access unless otherwise agreed. This ensures that developers, designers, and strategists can configure the store without interruptions.
- For Plus stores, users may also be added under Organization Settings for multi-store management.
- Access requests from Shopstars will always come through official Shopify invitations.
Advertising Accounts #
Meta Business Manager
- Shopstars is added as a Partner with Admin role.
- This allows campaign creation, pixel management, and ad spend monitoring without requiring client personal logins.
Google Ads
- Access is granted via Tools & Settings > Access and Security.
- Shopstars should be added as an Admin to configure conversions, link GA4, and manage campaigns.
TikTok Ads
- Invitations are sent from TikTok Business Center.
- Shopstars requires Manager access for campaign setup, pixel installation, and reporting.
Other Platforms
For Pinterest, LinkedIn, or regional ad platforms, access is provided via official business accounts. Credentials are never shared directly.
Analytics and Pixels #
Google Analytics 4 (GA4)
- Shopstars is added as an Admin under Property Settings.
- This provides access to configure events, link Google Ads, and create custom reports.
Tag Managers
- For clients using Google Tag Manager (GTM), Shopstars is added as an Admin at the container level.
- This allows event configuration while maintaining a record of all changes.
Communication and Approval #
All access requests are documented in Basecamp. Clients should confirm invitations before granting access to ensure authenticity. Any access provided is logged in the Basecamp project thread for traceability.
Security Best Practices #
- Do not share passwords by email or Slack. Always use invitation systems provided by each platform.
- Grant the minimum level of access required. If full Admin access is unnecessary for a given role, Shopstars will request a lower level.
- Revoke access promptly if roles change or projects end.
- Enable two-factor authentication (2FA) on all accounts where available to reduce the risk of compromise.
Client Responsibilities #
Clients are responsible for approving or rejecting access requests. They must ensure that all invitations are sent to official Shopstars accounts and not to impersonators. If clients are uncertain about any request, they should verify it in Basecamp before granting access.
Summary #
Account access at Shopstars is handled through official invitation systems, never by sharing passwords. Shopify staff accounts, Meta Partner Access, Google Ads Admin roles, and GA4 permissions are granted as needed. All requests are logged in Basecamp for traceability, and clients are expected to maintain security best practices, including two-factor authentication and timely revocation of unused access.
