One Admin Handles Many Client Social Accounts, So How Do You Keep Them Safe?

At agencies, this is a familiar sight: one admin handling five to ten client accounts at once. The quickest way to get started is familiar too: the client sends a username and password over WhatsApp, and the admin logs in on their phone. Everything runs smoothly, until that admin resigns, loses their phone, or an account gets locked because the OTP goes to someone else's number.

While directing content for more than 10 brands at Kyon Studio, I learned that the problem is rarely the admin. The problem is how the access works.

Why sharing passwords is risky

• Nobody can tell who did what. If five people log in with the same account, every action is recorded under the same name.
• When someone leaves, every password has to change. And usually nobody remembers who the password was shared with.
• Two-step verification is tied to one person's phone. If codes go to the personal number of an admin who has left, the client can be locked out of their own account.
• Passwords spread through chat history. One screenshot sent to the wrong person is enough to open an account.

Access by role, not by password

The big platforms already offer ways to grant access without sharing a password. Everyone signs in with their own account, and the account owner decides how far that access goes.

On Meta, according to the help page on giving a partner access to assets in your business portfolio, partial access can be limited to specific tasks, such as creating content, managing ads or responding to messages. Even with full control, a partner can't share the asset with another business, because only the organization that owns it can. The same page also asks you to turn on two-factor authentication for the business portfolio.

On TikTok, the Business Center roles page explains that Admins have full access, while Standard members only work on the accounts and assets they're given. On Google Business Profile, the page on managing owners and managers says everyone is invited by email and uses their own Google account.

Who should own the accounts

One principle matters most to me: the client owns the accounts, the agency is only given access. The Meta page above already shows the logic, since the asset owner holds the right to share it. If accounts are created under the admin's or the agency's name, the client may struggle to take back their own account when the engagement ends.

A checklist for agencies

1. Keep every client account in one list, with its owner, who has access and at what level. Building a list like this is similar to what I covered in Domains, Contracts, and Permits Expire and Nobody Notices.
2. Use role-based access wherever the platform offers it, and give only the access that's needed.
3. Turn on two-step verification and don't tie it to one person's personal number.
4. For accounts that still need a shared login, keep the password in a team password manager, not in chat.
5. Review access every month, especially after changes in the team or the client list.

When an admin resigns

Someone's last day on the team is when access is most often forgotten. Set the order of steps in advance:

1. Remove their access from each client's business portfolio, Business Center and business profile.
2. Change the passwords of any accounts that are still shared.
3. Move any two-step verification still tied to their number.
4. Make sure their files, templates and work notes live in the team drive, not their personal account.

That last point matters just as much for the AI and automations employees build, which I covered in When the Company's AI Resigns Along With the Employee.

Closing

Sharing passwords is the fastest way to start, but also the most expensive when something goes wrong. Role-based access takes a few more minutes up front, and in return the client keeps their accounts, the agency can still do its job, and team changes don't turn into a crisis.

If you manage many clients and want access lists, tasks and team reports tidy in one place, tell me what you need.

The photos in this article were made with AI, not photos of real people or places.