Shared marketplace accounts: 7 security rules
Seven practical rules for sellers who share marketplace panels as a team: shared accounts, verification codes and permissions.
GuideThe Passhield team2 minute read
An e-commerce seller's day runs through marketplace panels: orders, returns, campaigns, prices. Panels are usually shared by a few people; the password travels around the team while the verification code goes to one phone. These seven rules make that set-up safer without getting in the way.
1. Separate users where possible
Some marketplaces let you define separate users and permissions under the seller account. If yours does, use it instead of a shared password: who did what becomes visible, and when someone leaves you close only their user.
2. If a shared password is needed, keep it in one place
When separate users are not possible, keep the password in one secure place, shared with the people allowed to use it. A chat group, e-mail or a spreadsheet is not that place.
3. Not everyone needs to see everything
The campaign team needs the marketplace panel, not the accounting software. Split passwords into vaults by team and give each person only the access their work needs. In Passhield you can give someone "use" permission: they sign in with the extension but cannot see the password.
4. The verification code belongs to the team
If the code goes to one phone, work stops when that person is unreachable and the code ends up in chat groups. For app-based codes, scan the QR code into a shared, encrypted vault; for SMS codes, move the number to a company line. See our post on verification codes.
5. Protect API keys like passwords
API keys used for integrations are as valuable as the panel password: whoever knows the key can reach orders and products. Keep keys in the encrypted vault too, and replace them when the person who set up the integration leaves.
6. When someone leaves, close the panels first
In e-commerce the most critical accounts are the marketplace, payment and shipping panels. When an employee leaves, update their passwords and verification settings on the first day. The offboarding checklist generator lists marketplace panels ready to pick.
7. Review who can reach what
Every three months, look at who can reach each panel. Does the agency given temporary access for a campaign still have it at the end of the season? Timed access closes this kind of oversight on its own.
We describe how Passhield works for e-commerce teams on our e-commerce page.
In short
Separate users where possible, otherwise one secure vault; permissions by team, verification codes that belong to the team, and regular reviews. These seven rules keep the convenience of shared panels while closing the open doors.