Your login and 2FA: how agency access should work

Your account is your business. Whoever controls its password, its email address and its two-factor authentication (2FA) controls your content, your messages and your payout settings. Agencies need some way to work on your account, and there are good and less good ways to set that up. This guide explains the options and gives you a checklist for the start, the middle and the end of an agency relationship.

Educational guide. Related criteria: Account access and Where the money goes. General information, not legal or security advice for your specific setup.

The three keys to your account

Think of your account as having three keys. Whoever holds all three can lock everyone else out.

1. The password. It lets someone log in.
2. The account email. It lets someone reset the password. If another person controls the inbox, they can take over the account even after you change the password.
3. The 2FA method. An authenticator app or a phone number that confirms each new login. It is what stops a leaked password from becoming a lost account.

Two more things sit next to these keys: the payout details (where the platform sends your money) and the identity on the account. The account is registered to you after an ID check, so you remain responsible for everything posted and every message sent from it.

How agencies typically get access

Agencies describe their setup in different ways, but most fall into one of three models.

You keep all three keys

The team works through a separate login, a team feature or a management tool session that you can see and switch off yourself. You approve new devices. Leaving or pausing is a matter of removing that access.

Shared password, you keep the email and 2FA

The team logs in with your password, but the inbox and the 2FA stay with you. It works, but every new device needs your approval, and you will change the password whenever access should end. Make sure the agency knows that up front.

The agency holds one or more keys

The agency sets the password, uses an inbox it controls, or registers its own phone or app for 2FA. Day to day this can feel convenient. At the end of the relationship, it means you depend on the agency to hand the keys back.

Whichever model you choose, check your platform's current terms about who may access or operate your account. Platform rules change, and they apply to you as the account holder.

Before anyone gets access

Set these up yourself before you share anything:

• Use an email address that exists only for this account, with its own strong password and its own 2FA. Never share the inbox password.
• Choose a long, unique password for the account itself, stored in a password manager.
• Turn on 2FA with an authenticator app on your own phone, and save the backup codes somewhere offline that only you can reach.
• Make sure the phone number on the account is yours.
• Check that payouts go to a bank account in your name, and that changing payout details requires your 2FA.
• Write down who has access, how, and since when. You will want this list on the last day.

While you work together

• Review sessions monthly. Most platforms show active sessions or login history. Check that you recognize the devices and locations.
• Know which tools are connected. Management tools, schedulers and chat tools can keep their own access. Keep a list.
• Treat 2FA codes as cash. Only send a code when you are expecting a login from someone you know is about to log in. A message asking for a code "from support" is a common phishing move.
• Watch the settings that move money. Prices, payout details and referral settings deserve a monthly look.
• Keep your own copies of your content and of monthly statements.

When the relationship ends

Before you change anything, check the contract: if it gives the agency access until a set end date, cutting access early can start a dispute. If you believe your account is at risk, protect the account first and get advice afterwards. On the end date, work through this list in order:

1. Change the password of the account email, and check its recovery options.
2. Change the account password.
3. Log out all other sessions and devices.
4. Reset 2FA if there is any chance someone else has a copy, and generate new backup codes.
5. Remove connected tools and revoke any team or assistant access.
6. Check payout details, the phone number and the email on the account.
7. Review scheduled posts, automated messages, prices and promotions the team set up.

Our guide to leaving an agency covers notice, money and content in more detail.

How OF Agency Rankings scores this

We do not grade one access model above another. We score whether an agency's public pages say how it works. Under rubric v1.0, the Account access criterion gives:

• 10 points when the site states both who holds the credentials and how the team gets access;
• 5 points when it states only one of the two, for example a general "you stay in control";
• 0 points when we found nothing on the agency's public pages.

The Where the money goes criterion covers the related question of where payouts land and how commission is collected.

Questions to ask

1. Who will hold the password, the account email and the 2FA?
2. How exactly will your team access my account, and from how many devices?
3. Which tools will be connected to my account, and can I see and remove them myself?
4. Will you ever need to change my payout details or contact details? (The answer should be no.)
5. What happens to your access on the last day of the contract?

FAQ

Is it normal for an agency to ask for my password?

Some access models involve the team logging in with your password. What matters most is that you keep the account email and the 2FA, and that you can end everyone's access yourself in a few minutes.

Should I send 2FA codes over chat?

Only when you are expecting a specific login from someone you know. Never send a code because a message tells you to, even one that looks like it comes from the platform.

Can an agency change where my money goes?

If it holds your email and 2FA, it may be able to. Keep payout settings behind your own 2FA and check them every month.

What if the agency already holds my email or 2FA?

Ask for them to be moved back to you while the relationship is good, not on the last day. Plan the handover together and confirm it in writing.