Staff and Roles
Invite Your Team, Give Each Person the Right Access
As your store grows, more people help: a packer, a marketer, an accountant. Give each of them exactly the access their work needs, and take it away in one tap.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
Settings → Staff and Roles holds your team in four cards: Team, Invitations, Roles and Store Ownership.
- Invitations by email or phone. INVITE STAFF asks for an email or a mobile number, an optional name, and the access they get. An email invitation is sent for you (and never charged); a phone invitation gives you a link to COPY LINK or SHARE ON WHATSAPP. The link works once, for the days you choose (7 to start with), and only for the person whose confirmed email or phone was invited: anyone else who opens it is told whom it is for. RESEND replaces it (the old link stops working); CANCEL INVITATION kills it.
- Access: an admin can do everything in the store except the owner's own powers; staff get one or more roles and see only what those roles allow. A staff member with no role sees nothing until you give them one.
- Roles: four ready-made roles, and as many of your own as you need, each with a name, a line about what it is for, and exactly the permissions you tick.
- Switch access off keeps the person and their roles, but their rights stop at once. Remove from team ends their access to this store; their past changes stay in the activity log.
- For each person: their role, their two-step sign-in state (on, needed, or none) and when they last signed in.
The Ready-made Roles
| Role | For |
|---|---|
| Catalog Editor | Products and stock |
| Customer Support | Looking up orders and customers |
| Marketer | Discounts, content and reports |
| Order Manager | Orders and customers |
Ready-made roles stay as they are; DUPLICATE one to make your own version. Permissions are grouped as the admin is: Products, Orders, Customers, Marketing, Online Store, Analytics, Settings, Team, and Plan and Credits. They are specific: "See orders" is apart from "Process orders: ship, cancel, refund", "Edit page layouts (drafts)" is apart from "Publish page layouts", and "Export customer data" is its own tick.
Rules the Database Keeps
The rules that keep it safe are checked by the database, not only the screen: nobody changes, turns off or removes the owner or themselves; only an owner or admin manages an admin; a person who manages staff can never give a right they do not have. A role that is someone's only role cannot be deleted until they have another.
Handing over the store: the owner can make another active member the owner by typing the store's address to confirm. The new owner gets the plan, billing and the power to close the store; the old owner becomes an admin, and only the new owner can hand it back. The activity log records it as one clear line.
The admin's menu follows each person's rights, and a screen they may not use says so in plain words.
For your store
Why It Matters
Sharing one password with your whole team means you never know who did what, and you cannot take access back from one person without changing it for everyone. Separate accounts with roles fix both: everyone signs in as themselves, sees only what their work needs, and the activity log shows who changed what.
Small Indian stores often grow with family members, a part-time packer, a freelancer who runs the ads and an accountant who visits at the end of the month. Each needs a different slice of the admin. The packer needs orders, not your payout settings; the accountant needs reports and invoices, not your discount codes; the ads freelancer needs the marketing tags, not your customers' phone numbers.
Invitations by phone suit teams that live on WhatsApp: you send the link where you already talk, and it works only for the number you invited. When someone leaves, one tap ends their access, while the record of what they did stays.
Step by step
How It Works
Invite a Person
In Settings → Staff and Roles, press INVITE STAFF. Choose EMAIL or PHONE, type the address or the 10-digit mobile number, and add their name if you like. Pick Admin, or Staff with the roles they get. SEND INVITATION emails them a link; for a phone, CREATE LINK gives you the link to copy or share on WhatsApp.
They Accept
They open the link, sign in (or create their account with a code sent to the invited email or phone), and press ACCEPT INVITATION. They are now on your team with the access you chose. The link works only once and only for them; until they accept, the invitation shows under Invitations with who sent it and until when it works.
Shape a Role
Under Roles, DUPLICATE a ready-made role or press CREATE ROLE. Give it a name and a line about what it is for, tick its permissions group by group, and SAVE ROLE. You can only tick permissions you hold yourself, and the owner's own powers are never part of a role.
Change or Stop Access
From a person's menu, Change Access gives them other roles or makes them an admin. Turn Off Access stops their rights at once and keeps them on the list, ready to turn back on. Remove from Team ends their access to this store. Each change applies on their next click, and each is in the activity log.
Keep an Eye on Sign-In Safety
Each row shows Two-step on, Two-step needed or No two-step, and when the person last signed in. Choose who must use two-step sign-in in Settings → Sign-In and Security; a new team member gets a few days to set it up, with a reminder in their admin.
Hand the Store Over When You Need To
Under Store Ownership, the owner presses TRANSFER OWNERSHIP, picks an active member as the New Owner and types the store's address to confirm. The new owner takes over the plan and billing; you stay on as an admin.
Settings
Settings You Control
All are under Settings → Sign-In and Security → Staff Invitations.
Mercayo
Mercayo's Controls
The number of team accounts comes with your plan and is set by Mercayo; inviting past it is refused in words, with the number. Mercayo's team can limit invitation days for a store, with a reason your admin shows ("Set by Mercayo for your store"). Every check of who may do what runs in the database, for every request. Mercayo's support team never joins your team: when it helps inside your admin, it uses a separate, time-limited support session that cannot invite anyone or change roles unless Mercayo's owner allows it for that session.
Limits today
Good to Know Before You Start
- Phone invitations are shared by you (copy or WhatsApp); Mercayo does not send them by SMS.
- Three powers belong to the owner alone and cannot be given to a role or an admin: changing the plan and billing, handing the store over, and closing the store.
- The number of team accounts depends on your plan; open invitations count until they are accepted or cancelled.
- Ready-made roles cannot be edited; duplicate one to change it.
- A store owner cannot reset a team member's two-step sign-in; that is done by Mercayo's team, with a reason.
Questions
About Staff and Roles
Can I see who did what?
Yes. Every change a team member makes to products, orders, prices, settings and the rest is in the activity log with their name at the time, when it happened and, for plain fields like a price or a status, the old and new values.
What happens when someone leaves?
Turn their access off or remove them from the team; their rights stop at once, on their next click. Their past changes stay in the activity log, shown with their name.
Can a staff member give themselves more rights?
No. Nobody can change their own access, and nobody can give a right they do not have themselves. These rules are checked by the database, so no screen or trick can get round them. Only the owner or an admin can manage an admin.
Can I hand the store to a partner?
Yes. The owner can transfer ownership to an active member of the team by typing the store's address to confirm. The new owner gets the plan, billing and the power to close the store; the old owner becomes an admin. Only the new owner can hand it back.
Can I invite someone who has no email address?
Yes. Invite them by mobile number and share the link on WhatsApp. They accept with an account on that number, confirmed with a code. The link works only for that number, so forwarding it to someone else does not help them.
How many people can I add?
It depends on your plan: 2 accounts on Starter, 5 on Growth and 15 on Scale, the owner and open invitations included. The Team card shows how many are in use. Cancel an invitation or remove someone to free a place, or move to a bigger plan.
What can an admin not do?
An admin can do everything in the store except the owner's own powers: changing the Mercayo plan and billing, handing the store over and closing the store. An admin also cannot change the owner's access.
Does a role count in my other stores?
No. Roles and access are per store. A person on the teams of two stores has separate access in each, and what they may do in one never carries over to the other.
Related
Related Features
- Two-Step Sign-InYour team signs in with a password and a code from an authenticator app, with recovery codes, and you choose who must use it.
- Activity LogEvery change your team makes to products, orders, prices, settings and more is written down by the database, in plain sentences, with filters and a CSV export.
- Admin on Your PhoneEvery admin screen works on a phone: a bottom bar with your main screens, a More sheet with the rest, cards instead of tables, and touch and hold to select.
- Store IsolationEvery store's orders, shoppers and products are walled off by the database itself, and tests prove one store can never reach another's.
- Plans and BillingA free trial, then a monthly or yearly plan: your use against its limits, every payment with its GST invoice, and nothing deleted if a payment is late.
More in Security and Trust: Store Isolation · Two-Step Sign-In · Activity Log · Support Access · Encrypted Keys · Privacy and Consent
Try It on Your Own Store
Every feature is in every plan, free for 14 days.