How to give an agency access to your social media accounts without sharing passwords

Handing an agency the login is the default because it takes one message. A shared password lets the agency do anything the owner can do while signed in, and the only way to take it back is to change the password for everyone who uses it. Several platforms say outright that their roles exist so nobody has to share one (YouTube, X, Pinterest).

Every platform below has a better route. The business keeps ownership and adds the agency, or each person at the agency, under their own login with a named role. This page covers where that role lives on each platform, which role is the lowest that can still publish, and how to remove it. Every row was checked against the platform's own help pages or official posts on 2026-09-28.

Why is a role safer than a shared password?

Four differences matter in practice.

• Each person signs in as themselves. Their own two-factor authentication applies, and some platforms let you make it compulsory. Whoever has full control of a Meta business portfolio can require two-factor authentication for admins only or for everyone (Meta). TikTok Business Center admins can require 2-step verification for only admins or all members (TikTok).
• The role limits the damage. Someone with Meta's Content task can publish as the Page but cannot give anyone else access; only full access includes that (Meta). A password cannot be limited.
• Removal is one action. Removing a partner ends their access without touching anyone else's login. YouTube's own help page says granting permissions "is safer than sharing your password" (YouTube).
• Recovery stays with you. Google's help page names the recovery phone and email as how you get back into an account after a lockout (Google Account Help). On X, only the owner manages the password, phone number and login verification settings, whatever role a delegate holds (X).

Roles do not move responsibility: X states that account owners are responsible for what their admins and contributors post (X).

Per-seat pricing tempts teams to share one login inside the tools they pay for too; sharing a Hootsuite login covers that trade-off and the tools FAQ covers roles inside tools. This page stays with the platforms' own roles.

Where does each platform grant agency access?

One row per platform, from each platform's help pages, checked 2026-09-28.

Where the invitee column names no 2FA rule, the linked help pages state none the owner can enforce. Ask for it in the contract instead.

Details that change how you use the table:

• Meta partners stay inside what you gave them. A partner with full control of an asset "can manage everything" in it but cannot share it with another business. A partner with partial access can only pass the tasks you assigned on to its own staff (Meta).
• Meta access can expire. Temporary access gives an individual basic access for 3 to 75 days, then removes them from the portfolio and its assets automatically (Meta). It suits a trial project with a freelancer.
• Threads is becoming its own asset. Since September 2026 a Threads profile in a portfolio gets its own Content, Ads and Everything access, and Content is enough to post. Meta is rolling this out gradually, and existing Threads profiles start with the access inherited from their Instagram account (Meta).
• TikTok needs verification in some regions. A Business Center registered in the US, EU or UK needs a Verified Business Account to link an account for account management (TikTok). Sharing with a partner also needs the "TikTok account sharing" permission from the account user (TikTok).
• Revoking on TikTok stops ads at once. Removing a partner immediately pauses any active campaigns it runs with the account's identity (TikTok). Time it for the end of a campaign.
• YouTube Brand Accounts come first. A channel on a Brand Account has to switch to channel permissions before these roles apply (YouTube).
• Google Business Profile has a 7-day wait. A new owner or manager cannot remove other owners or managers, or transfer primary ownership, for 7 days (Google).

Which role matches the agency's job?

Agencies do one of three jobs, and the lowest sufficient role differs for each.

Sources: the help pages linked in the first table, plus LinkedIn's Page admin roles and TikTok's partner sharing page.

Two caveats. TikTok's help pages disagree on a read-only option: a May 2026 page lists a TikTok account analyst, while the September 2026 overview names only Deliver ads and Manage account. Check what your Business Center offers before promising read-only access. On X, a reporting-only agency needs Admin, which can also invite other delegates.

How do you add an agency on each platform?

Meta: Facebook Pages and Instagram accounts

1. Put the Page and the Instagram professional account in your business's own portfolio first. An Instagram account can sit in only one business portfolio, so add it before anyone else does: Settings > Instagram accounts > Add, then log in to Instagram (Meta).
2. Ask the agency for its business portfolio ID.
3. In Meta Business Suite, go to Settings > Partners > Add > Give a partner access to your assets, and enter the ID.
4. Select the Page and the Instagram account, choose partial access, and tick only the tasks the agency needs.
5. Click Assign assets. Someone else with full control of your portfolio may need to approve it (Meta).

For a freelancer without a portfolio, use Settings > People > Invite people with the email on their Facebook account. People join with basic access by default; assign the same tasks on the assets, and set temporary access if the project has an end date (Meta, Meta).

LinkedIn Page

1. Check the person follows the Page and is within your 3rd-degree network.
2. In the Page's super admin view, go to Settings > Manage admins > Page admins (or Paid media admins for ad roles) > Add admin.
3. Search the name, pick Content admin and click Save (LinkedIn).

TikTok Business Center

1. In your own Business Center: Accounts > TikTok accounts > Add a TikTok account > Link an existing TikTok account > Send a QR code.
2. Select Manage account. For posts that should appear on the profile, choose "Show on TikTok profile and in ads". Turn on TikTok account sharing if an outside agency will use the account.
3. Someone logged into the TikTok account scans the QR code in the app and grants the permissions. A personal account is prompted to switch to a Business Account (TikTok).
4. Add the agency as a partner with its Business Center ID (TikTok).
5. Open the TikTok account (View), then Partners > Share with partner, and pick the permissions. You can pass on only what your Business Center holds (TikTok). For your own staff, use the account's Members tab instead (TikTok).

YouTube

1. If the channel is on a Brand Account, migrate to channel permissions first.
2. In YouTube Studio, go to Settings > Permissions > Invite.
3. Enter the email, choose Editor (limited) and click Done. The invite expires 30 days after it is sent (YouTube).

Pinterest

1. Ask the agency for its business ID, shown in the left panel of its Business Manager (Pinterest).
2. Menu > Business Manager > Partners > Add partner. Choose the role, enter the business ID and select Invite a partner to access your assets.
3. Click Show assets. On the Profile tab, tick Publisher next to your profile. Add ad-account permissions only if the agency runs ads.
4. Send the invite; the agency accepts it by email (Pinterest).

Publisher is not customizable: it covers the cover photo, boards, Pins, Pin scheduling and Pin stats.

Google Business Profile

1. Open your Business Profile, then More > Business Profile settings > People and access.
2. Click Add, enter the email, choose Manager and click Invite (Google).

Keep the primary owner role yourself.

X

1. Log in to x.com as the brand account.
2. Go to Your account > Security and account access > X Delegate > Invite a member.
3. Enter the person's name or @username, choose Contributor and click Send invite. They accept it in Delegate on x.com (X).

Bluesky

1. Create an app password in Settings, named after the agency. Leave "Access to DMs" off unless they handle messages (Bluesky).
2. Send it through a channel you would trust with a password; it has most of the abilities of your main password (Bluesky).
3. Delete it when the work ends. Account deletion and creating more app passwords stay with your main password (Bluesky).

What should the owner never hand over?

Roles only protect you if the top of each account stays with the business.

• The top role. Keep owner, full control, super admin or primary owner with at least two people the business employs. Meta recommends more than one admin on a Page so someone you trust can get you back in (Meta). LinkedIn requires at least one super admin on every Page, and a sole super admin must assign another before removing themselves (LinkedIn). A Business Profile has exactly one primary owner, who must transfer the role before leaving (Google).
• Full control of the business portfolio. Only people with full control can add or remove partners (Meta, Meta), and anyone with full control can remove people from the portfolio (Meta). Give agency staff basic access, never full control.
• The recovery email and phone. They decide who gets back in after a lockout. Use an address and number the business controls, not an agency inbox or one person's mobile.
• The accounts' home. Add Instagram accounts to your own portfolio and TikTok accounts to your own Business Center, then share outward. When a partner holds an asset and shares it with you, you are limited to the permissions the partner assigned (Meta).
• Payment and finance access. Meta's finance access and TikTok's Finance Manager and Finance Analyst roles are separate from posting roles (Meta, TikTok). Grant them only if the agency pays for ads on your account.

Treat access requests you did not expect with suspicion. Meta advises denying Page access requests from businesses you do not know, and says Facebook never asks for access to a Page (Meta).

Frequently asked questions

Can an agency manage my Facebook Page without my password?

Yes. Add the agency as a partner in your Meta business portfolio and give it partial access with the tasks it needs. The agency needs its own business portfolio and has to give you the portfolio ID. Its staff then work under their own Facebook logins.

Should I give the agency admin or full control?

Only for a job that needs it, such as managing other people's access. Posting and replying have lower roles on every platform in the tables above that has roles, and so does reporting, except on X, where post analytics come only with Admin. Full control on Meta and Owner or Admin on X include the power to add and remove people.

What if the agency set up our accounts and holds the top role?

Then the business is the guest on its own accounts. Ask for ownership to be moved to the business before anything else changes. Agency offboarding: how to take back your social media accounts covers ownership transfers per platform and what to do when an agency will not hand them back.

Do I need to change the password after setting up roles?

If the password was ever shared, yes, and check the recovery email and phone at the same time. On X, delegates keep their access when the owner changes the password, and X encourages the owner to change it so only they know it (X).

What should the contract say about access?

Who owns each account, which role the agency gets on each platform, who holds the recovery details, and what happens to access when the contract ends. The client onboarding checklist lists these clauses with the rest of the setup.