Shopify B2B Company Profiles: Companies, Contacts and Permissions.

How Shopify's Company object actually works: the company, location, and contact structure, the two native permission levels, the numeric limits, and where buyer-side controls end.

What is a company profile in Shopify B2B?

Shopify's native B2B feature models every business buyer as a company record in the Shopify admin. The company is a container. Underneath it sit company locations, the entities you actually sell to, and company contacts, the people who order on the company's behalf. Every B2B configuration decision, catalogs, payment terms, tax settings, checkout behavior, hangs off one of these three objects, so the structure is the foundation for everything else in the Shopify B2B knowledge base.

Two placement rules shape everything downstream. First, catalogs attach only to company locations, never to the company as a whole and never to an individual contact; pricing therefore follows the location, a mechanic covered in depth in catalogs and price lists. Second, orders and draft orders can be associated with the company, a specific location, or a specific contact. For what else lives at the location layer, see company locations explained.

What permissions can a company contact have?

This is the part of Shopify B2B company profiles that surprises most teams. Shopify documents exactly two permission levels for company contacts, set per location: Ordering only and Location admin. There is no third tier, and no way to define your own.

Roles are assigned per contact-and-location pair, so the same person can be Location admin at one location and Ordering only at another. In the Admin API these surface as CompanyContactRole objects on Company.contactRoles, with assignment handled by the companyContactAssignRoles mutation. The main contact created with a company receives Ordering only by default and must have an email address.

Just as important is what no contact role can do natively:

• Custom roles or intermediate permission tiers: NOT NATIVE
• Per-contact spend limits or order ceilings: NOT NATIVE
• Buyer-side order approvals (manager sign-off before submit): NOT NATIVE
• Contacts managing other contacts from the account: NOT NATIVE

Adding customers, setting permissions, and removing customers are all Shopify-admin operations performed by your staff. A Location admin at the buying company cannot invite a teammate; they open a ticket with you instead.

What are the numeric limits on companies, locations, and contacts?

Shopify publishes hard caps on the company object. These matter when you sell to large accounts or sync structures from an ERP.

The 50-customers-per-location cap is the one that bites first for large distributor accounts: a single warehouse or branch cannot carry more than 50 buyers. Deletion is also constrained: a company with existing orders cannot be deleted, and a location can be deleted only if it has no draft or finalized orders. Shopify documentation does not state a limit on how many locations a single contact can be assigned to.

How do B2B buyers log in and what do they see?

B2B runs exclusively on Shopify's customer accounts, the passwordless kind. A buyer enters the email address associated with a company location and receives a six-digit one-time code; no password is ever set. Legacy customer accounts are not compatible with B2B, so headless builds must migrate any legacy login code before enabling it.

Buyers must sign in before they can see B2B products, pricing, or place an order. A contact assigned to multiple locations selects which location they are buying for before adding to cart, and that selection determines the catalogs, pricing, tax exemptions, and checkout settings that apply. Inside the account area, buyers can view order history and location details, track orders, duplicate past orders to reorder, submit and track returns, use saved payment methods, and update their profile and addresses where their permission allows. Merchants who want to extend that surface do it with Customer Account UI Extensions.

What order controls exist per location?

Native B2B offers three per-location levers over how orders are placed:

• Checkout to draft. A location can be set to "Submit all orders as drafts for review", turning every order into a draft order that your staff reviews, or to submit orders automatically. Covered further in B2B checkout and draft orders.
• One-time shipping address. "Allow customers to ship to any one-time address" lets a buyer ship somewhere not on file; when disabled, the shipping address is locked at checkout.
• Payment terms and deposits. Net terms (for example Net 30) and deposit requirements are configured per location via BuyerExperienceConfiguration, which exposes fields like payNowOnly and deposit. Details in payment terms and net terms.

Where is the buyer-side approval workflow?

There is not one. This is the single most consequential gap in Shopify B2B company profiles for procurement-driven buyers.

Teams coming from procurement suites expect submit, approve, pay as a sequence. On native Shopify B2B, every contact with Ordering only permission can spend without limit, and the merchant absorbs the review burden through draft orders. That works for small accounts; it breaks down when the buying company has its own controls to enforce.

How do you manage company profiles in the admin and API?

Creating a company requires only a name; addresses, tax information, payment terms, catalogs, and metafields are all optional. Editing company details applies across all locations, while tax IDs and exemptions are edited per location, and new locations can copy settings from an existing one. There is no native bulk import: Shopify's own docs point to Matrixify, a third-party app, for spreadsheet imports.

Onboarding is handled by the B2B access email, a customizable notification (Settings, then Notifications, then Customer notifications) sent when you check "Notify customer that they can start placing B2B orders", in bulk from the company page, or automatically through a Shopify Flow template. Removing a buyer means deselecting locations in the customer profile's Permissions section, or using "Remove from company" for full removal.

On the API side, company objects require the read_companies and write_companies scopes (or the customer equivalents), and the shop must have access to B2B. Since API 2024-10, your own sales staff can be scoped to specific company locations with companyLocationAssignStaffMembers, limiting an assigned staff member's actions to objects associated with that location. Assigning a contact role programmatically looks like this:

mutation AssignContactRoles($contactId: ID!, $roleId: ID!, $locationId: ID!) {
  companyContactAssignRoles(
    companyContactId: $contactId
    rolesToAssign: [{ companyContactRoleId: $roleId, companyLocationId: $locationId }]
  ) {
    roleAssignments { id role { name } companyLocation { name } }
    userErrors { field message }
  }
}

Which Shopify plans include company profiles?

Company profiles are no longer a Plus exclusive. Companies, company locations, and location-level permissions are included on Basic, Grow, Advanced, and Shopify Plus at no extra cost, alongside net terms, vaulted cards, checkout to draft, quick order lists, PO numbers, and Shopify Flow B2B objects.

A short list stays Plus-only: unlimited B2B market catalogs, direct company and location catalogs, deposit requirements, partial payments, and payment requests per fulfillment. Contextual checkout and contextual storefronts through Shopify Markets require Advanced or Plus. For the full ledger of what native B2B does and does not include, see the constraints ledger.

Frequently asked questions