Never Give Your Agency Your Password — Here's What to Do Instead

A new agency sends over their onboarding email. Buried in it: “Please send your Google Ads username and password, and the Facebook login for the business page.“

Most business owners either send it over without thinking, or refuse and feel paranoid about it. Both reactions miss the point.

The problem isn't that your agency is going to steal from you. The problem is that sharing a password is the worst available option, and every single platform they're asking about has a built-in, better one. An agency that asks for your password is telling you something about how they operate — and none of what it tells you is good.

What actually goes wrong when you share a login

This isn't theoretical. Every one of these is a routine, predictable failure:

Two-factor authentication locks everyone out. Your Google account texts a code to your phone. Your agency logs in from an office 1,800 miles away, triggers a verification prompt, and now they need you — mid-workday — to read them a six-digit code. This happens every time they log in from a new device or network. Multiply that by five people at the agency and you've built a permanent interruption machine.

Google and Meta flag the login as suspicious. Both platforms watch for a single account signing in from wildly different locations. The usual outcome isn't a polite email — it's a locked account, a forced password reset, or ads paused for review. Your campaigns go dark for reasons that have nothing to do with your campaigns.

You can't revoke one person. An agency employee leaves. If they had proper delegated access, you remove that one user in ten seconds. If they had your password, that password is now in that person's head, their password manager, maybe a Slack message from 2024. Your only fix is to change the password — which locks out the whole agency and every tool connected to the account.

You lose the audit trail. Google Ads logs who made each change. With shared credentials, every change — yours, your agency's, the intern's — shows up as the same user. When spend spikes overnight or a campaign gets paused, there's no way to find out who did it. That matters enormously the day something goes wrong.

One password becomes many. Your Google login isn't just Google Ads. It's Analytics, Search Console, your Business Profile, Gmail, Drive, and possibly your entire company's email. You wanted to hand over one ad account; you handed over your business's front door.

The other agency's password problem becomes yours. Agencies get phished like everyone else. If your credentials live in a shared doc at a company you don't control, their security failure is your locked account.

The part almost nobody thinks about: ownership

Here's the version of this story that costs real money.

Some agencies don't ask for your password — they do the reverse. They create the ad account, the Business Manager, the Google Business Profile, or the domain under their own account, and just add you as a user. It feels frictionless. You never had to send a password. Everyone's happy.

Then you leave.

And you find out you never owned any of it. The ad account with three years of conversion history — the history that makes your Smart Bidding work — belongs to them. The Business Manager belongs to them. Sometimes the domain does too. You're not “moving your accounts,“ you're starting from zero and paying for the privilege.

Proper delegated access prevents both failure modes at once. You own the asset. They get keys. The keys come back when they leave.

What proper access actually looks like

Every major platform has solved this. Not with workarounds — with first-class features built specifically for agencies:

Google Ads uses manager accounts (MCC). Your agency sends a link request from their manager account, you approve it inside your own account, and they can now work in it while you remain the owner. You revoke it from your own settings whenever you want. No password changes hands.

Meta uses Business Manager partner access. You share your ad account, page, and pixel with the agency's Business Manager by its ID number. Their team gets in through their own logins with their own 2FA. Remove the partner and everyone from that agency loses access instantly.

Google Business Profile has Manager and Owner roles. Your agency should be a Manager — full editing ability, zero ability to remove you or transfer the listing. Never make an agency a Primary Owner.

Google Analytics 4 and Search Console both grant access per email address with granular permission levels. Read-only, edit, or admin — your call, per person.

WordPress, Shopify, and most CMS platforms create individual user accounts with roles. Your agency gets an Editor or Admin account tied to their email, not yours.

The pattern is identical everywhere: the platform links their account to your account. Two separate identities, one shared workspace, revocable in one click.

The three-question test for any agency

Before you send anything, ask:

1. 1.“Can you request access through your manager account / Business Manager instead of using my login?“ A competent agency says “yes, of course“ and sends you their ID number. An agency that pushes back on this either doesn't know how, or doesn't want a revocable relationship.

1. 1.“Whose name will the accounts be created in?“ The answer must be yours. If they've already built assets under their own umbrella, ask when they'll transfer ownership to you — and get it in writing.

1. 1.“When we part ways, what's the offboarding process?“ There should be an answer. Removing a partner from Business Manager takes about fifteen seconds. If the answer is vague, the accounts probably aren't really yours.

The uncomfortable reason agencies ask anyway

To be fair to the industry: sometimes it's not malice, it's friction. Walking a busy contractor through Business Manager over the phone is genuinely harder than saying “just send me the login.“ Passwords are the path of least resistance for the agency — and they push the cost of that shortcut onto you.

The fix isn't to make you learn Meta's permissions model. The fix is for your agency to hand you clear, screenshot-by-screenshot instructions for the exact platform you're on, so proper access takes less time than digging up a password would have.

That's why we built one. Our Client Access Center has step-by-step guides for every platform we touch — Google Ads, Meta Business Manager, Google Business Profile, GA4, Search Console, WordPress, Shopify and more. No password required for any of them, and most take under two minutes.

The one-line version

You should never have to give anyone your password, because you already have something better: the ability to grant them access and take it back. Use it.

If you're not sure who currently owns your accounts — or you suspect a previous agency still has keys you can't take away — that's worth checking today, not the day you want to leave. Get in touch and we'll walk your accounts with you.