Roles and permissions

A role is a User Group of type Admin. Each staff member belongs to one or more roles, and the role's privileges decide what they can see and do.

Create a role

1. Open Customers → User Groups and click New User Group.
2. Name it after the job, for example Packing team, Catalog editor or Store manager.
3. Set Type to Admin and Status to Active, then create it.
4. Open the group. Under Privileges, set each area to No Access, Read Only or Read & Write. Use the search box to find an area quickly, for example "orders" or "payments".
5. Click Save Privileges.

Areas include Orders, Products, Categories, Customers (Users), Pages, Design and Theme, Marketing, Promotions, Payments, Shipping, Reports, Settings, Billing & Plans, API Keys, Backups and more. On marketplace stores there are also vendor areas.

Example roles

Good to know

• The menu only shows what a person may open, so a packing team member simply doesn't see Settings.
• On pages they can only read, edit buttons are hidden (for example Edit Order and Refund).
• CartWhizz AI follows the same permissions: it never does something the person asking could not do themselves.
• Only the store owner can restore a backup or change the owner.

Custom code: owner and admins only

Code that runs on your storefront can read anything a shopper types there, so only the store owner and admins may add, change or delete it. This covers a page's Custom HTML code (in the layout editor and the design editor) and Tracking Scripts.

• The Custom Code privilege (under Design) controls it. The default admin group has it; the owner always has it.
• Staff with only Layouts keep editing blocks, text, images, menus and page SEO. They see the custom code read-only, with the note Only the store owner or an admin can edit custom code.
• When they save a page, its existing code stays exactly as it was. They also can't delete a page that has custom code.
• Give Custom Code to a custom role only if you would trust that person with your admin login.