How to onboard a social media client without sharing passwords

Reviewed: 20 October 2026
By: Inkrush editorial team

The client should keep ownership of every social account and grant the agency access through the platform's official role, business or OAuth permission flow. Record who owns the account, what access was granted, who can revoke it and how recovery is controlled. Never ask a client to email or message their password.

This creates a cleaner boundary: the client retains ownership and recovery control, while each agency team member or approved tool receives only the access needed for the agreed work.

1. Inventory every profile and its owner

Start with a register rather than a collection of login details. For each account, record:

• platform and canonical profile, Page or channel URL;
• client-side owner;
• recovery owner, without recording recovery credentials;
• agency user or role granted;
• permission purpose and minimum scope;
• date granted and last verified date;
• whether multi-factor authentication is confirmed;
• connection state and non-sensitive follow-up notes; and
• the person responsible for revocation during offboarding.

This reveals orphaned accounts, duplicate profiles and situations where a former employee is still the only owner before the agency begins publishing.

Who should own a client's social media accounts? The client should retain ownership and recovery control. Agency staff and tools should receive revocable access appropriate to their work rather than taking ownership unnecessarily.

2. Confirm recovery and multi-factor authentication

Before connecting a scheduler or adding agency users, ask the client to confirm that its recovery email and phone are current and controlled by an appropriate person. Confirm multi-factor authentication is enabled where available and that the client has a documented recovery process.

The access register should record who owns recovery and whether the check was completed. It should never contain recovery codes, secret answers or one-time passwords.

3. Use official roles or OAuth connections

Keep these three activities separate:

1. Human access through platform roles. The client adds an agency team member or partner and chooses an appropriate role.

2. Tool access through OAuth. An authorised client representative signs in with the platform and consents to the permissions requested by the scheduling tool. The agency does not need to collect the social password.

3. Content approval. A client reviews a proposed post. Approving content does not grant the agency account access or authorise a scheduling tool.

Can a scheduler publish without storing a social password? Yes. A supported scheduler can use the platform's official OAuth authorisation and revocable tokens. The client still needs an eligible account and authorised person, and platform permissions and provider rules continue to apply.

4. Request only the permissions needed

Map each task to a permission before requesting access. Someone preparing content may need different access from the person managing account settings, billing or other administrators.

Avoid granting full control by default. Full-control roles can sometimes add or remove people, alter settings or delete an account. Use the least privilege that supports the agreed service, then expand access only for a documented need.

5. Keep each client in a separate workspace

Separate each client's connected accounts, brand inputs, media, content and calendar. A shared agency view can help coordinate work, but it should not merge private links, tokens or client-specific materials into one uncontrolled document.

The one-time Inkrush intake link collects onboarding and Brand Kit details; it does not connect social accounts. The link is valid for 30 days and becomes unusable after submission. Social connections are started by a signed-in Inkrush owner or a manager with connection permission, in the correct client workspace. An authorised account owner or administrator then grants access at the social platform. An intake or approval link does not grant access to this connection flow. Human or business-role access is granted separately on the platform. The intake form should never ask for a social password.

Learn more about separate client workspaces and social media management for agencies.

6. Test with non-sensitive content

After access is granted, verify the intended workflow with a low-risk item agreed with the client. Check the destination profile, local time, media and caption, then confirm the result in the platform where appropriate.

Do not use confidential launches, regulated claims or time-critical promotions as the first test. A successful connection to one account or action does not prove every format and platform option will behave identically.

If client review is part of the service, test that separately from account onboarding. Inkrush approval links are bearer links sent to named client approvers. They expire after 90 days. Reissuing a link, or successfully sending an approval digest, rotates the token and invalidates the previous link. They are not identity verification, and forwarding a live link can grant access to the review.

Explore the client approvals feature.

7. Record consent, verification and expiry

Record the date access was granted, its purpose, scope and approving client representative. Set a review date and re-check access when the contract, agency team or platform requirements change.

Do not paste access tokens or private approval links into the register. A status such as “connected, verified 20 October 2026” is useful; the credential itself is not.

8. Build offboarding into onboarding

An offboarding checklist should identify:

• each agency person, partner and tool with access;
• who will revoke or remove it;
• connected apps and sessions to review;
• scheduled or draft content requiring a decision;
• agency-held files that must be returned or retained under contract;
• recovery information the client should re-check; and
• the date revocation was verified.

What access should be removed when an agency contract ends? Remove agency people, partner access and tool authorisations that are no longer required; review scheduled work and connected sessions; and verify that the client still controls ownership, recovery and active administrators.

In Inkrush, archiving a workspace pauses posting and disables its public client links while retaining posts, media and history. It does not itself revoke the social platform’s permissions. Decide what should happen to scheduled posts, then separately disconnect tools and remove provider roles that are no longer needed. Verify those removals with the client.

Platform guidance checked 20 October 2026

Platform interfaces and permissions change. Confirm the current official instructions before each onboarding.

Facebook Pages

Meta distinguishes Facebook access from task access. People with task access can manage assigned work through tools such as Meta Business Suite without switching into the Page. A person with full control can manage access and may be able to remove others or delete the Page, so reserve that level for people who truly need it.

How does an agency get access to a Facebook Page? An existing person with the required control grants the agency's individual users or business the appropriate Facebook or task access. Do not exchange the client's Facebook password. See Meta's current guidance on Page access and giving or removing Page access.

Instagram and Threads

Use the current official Meta connection and permission flow for the client's eligible account and intended work. Because account type, linked-Page configuration and feature approvals can affect what is available, this guide does not prescribe a universal click-by-click path. Confirm the current flow during onboarding rather than transferring a personal password.

LinkedIn Pages

LinkedIn Pages do not have separate Page login credentials. Admin roles are assigned to individual member profiles, and LinkedIn says sharing login credentials violates its policies. Choose among the current Super admin, Content admin and Analyst roles according to the work required. Third-party posting and API association can carry their own role or approval requirements.

See LinkedIn's current guidance on Page admin access and Page admin role permissions.

This is general LinkedIn Page administration guidance. Inkrush currently supports LinkedIn personal-profile text publishing; do not treat Page admin access as evidence that Company Page publishing is available in Inkrush.

YouTube

YouTube channel permissions allow a client to invite people at defined levels without giving them access to the owner's Google Account. YouTube describes this as safer than password sharing. Choose the lowest role that supports the work; for example, an Editor can upload and publish but cannot manage permissions or delete the channel.

Channel roles and scheduler authorisation are separate. YouTube states that invited channel-permission users cannot access YouTube APIs. A Studio invitation alone therefore does not establish that a third-party scheduler can publish. Verify the supported OAuth connection with the authorised account representative.

See YouTube's guidance on channel permissions and Brand Account owners and managers.

X

X Delegate allows an owner to invite an Admin or Contributor without sharing the account password. Choose the role for the work: an Admin can manage delegates, while a Contributor cannot. Delegate access and a scheduler’s OAuth authorisation are separate permissions. Remove departing staff and revoke unneeded connected apps separately.

See X’s Delegate guidance and connected-app permissions and revocation guidance.

TikTok

TikTok Business Center supports members and asset-level permissions. Only Business Center admins can assign relevant account and asset access, and a Standard member is limited to assigned resources. The available permission levels vary by asset and intended activity, so confirm whether the work concerns organic account management, advertising or both.

See TikTok's current guidance on adding Business Center members, assigning account and asset permissions and granting member access to TikTok accounts.

Business Center asset access is separate from publishing. TikTok videos upload from Inkrush, then you finish and post them in the TikTok app.

Questions agencies ask

Should a social media manager know a client's password?

No. Use official roles, partner access or OAuth consent. Password sharing weakens individual accountability and may breach platform rules.

Who can revoke access?

The client should retain at least one appropriate owner or administrator who can remove agency roles and revoke connected apps. Record the named revocation owner before work begins.

Does an approval link prove the reviewer's identity?

No. A bearer approval link grants access to whoever possesses it until it expires, is rotated or the approver is archived or deactivated. Send it to the named reviewer through an agreed channel and reissue it if exposure is suspected.

Keep the access register in the working client process

Use the fields in this guide as an in-page checklist, then keep the live access status with the client's controlled operating records rather than creating another downloadable spreadsheet.

Fictional access-register example

The following example is invented to show the fields. It contains no customer account or connection details.

• Client workspace: Example Café (fictional).
• Account: Example Café’s YouTube channel; record its public channel URL in the live register.
• Client owner and recovery owner: Client operations lead; recovery control confirmed by the client.
• Agency person and purpose: Assigned video editor; prepares and publishes agreed videos.
• Human permission: YouTube Editor; confirmed by the client. This does not grant API access.
• Tool authorisation: Not connected. A separate supported OAuth connection must be authorised before scheduler use.
• Verified: 20 October 2026, by the agency account lead with the client.
• Next review: At the next monthly account review, or sooner if staff or scope changes.
• Revocation owner: Client operations lead; remove the agency invitation and any separate tool authorisation at contract end.
• Status: Human access confirmed; scheduler connection outstanding. No scheduled publication assumed.

Keep the live register in the client’s controlled operating records. Never store passwords, recovery codes, tokens, secret answers or private approval URLs. Use written status labels so the record remains understandable without colour.

Offboarding sign-off

• Agree which pending posts should be cancelled, transferred or completed.
• Pause agency publishing and review any enabled repeat or automation settings.
• Remove agency users and partners from the relevant platform roles.
• Revoke scheduling-tool authorisations that are no longer needed.
• Verify the client still controls account ownership and recovery.
• Return or retain files according to the contract, and record who checked each removal.

For the ongoing planning process, use the multi-client content calendar guide and client approval workflow.

Bring the agreed workflow into Inkrush

Use a separate client workspace for brand details, content and supported social connections. Set the review process before putting posts on the calendar. Compare Inkrush plans and start a 14-day trial. A card is required; cancel before the trial ends to avoid a subscription charge.

For related product and security questions, see the Inkrush FAQ.