Managing Client Accounts at an Agency

Partner access first

Before any tooling, check which access model each platform offers:

• Meta. The client gives your business portfolio access to specific assets through partner access, using your portfolio ID, with full or partial permissions. A partner cannot re-share an asset with another business.
• Google Ads. A manager account lets you view and manage several client accounts from one sign-in, with different access levels for your staff, and without logging in as the client.
• Shopify. Collaborator accounts give Shopify Partners access to a client store with permissions the owner controls.
• eBay. Team access lets a seller invite people with specific Seller Hub permissions, each signing in with their own eBay account.

Partner access keeps an audit trail of who did what, keeps the client in control and lets you leave cleanly. It also means your agency's actions are recorded against your agency, not against the client's personal login.

Credentials and 2FA

Some platforms, and many small clients, still mean a shared login. Treat those credentials as the client's property held in trust.

The Instagram Terms of Use are a useful reminder: you may not create an account for someone else without their permission. Get written authority for every account you manage or create, and keep it with the client record.

NIST's Digital Identity Guidelines, SP 800-63B, revised in 2025, set a sensible baseline: passwords used as a single factor should be at least 15 characters, services should not force periodic password changes, and changes should be forced when there is evidence of compromise. NIST's highest assurance level requires phishing-resistant cryptographic authenticators.

In practice:

• A password manager with one vault or collection per client, and access only for the people on that client.
• Two-factor codes stored per client, not on one staff member's personal phone.
• Passkeys or security keys where the platform supports them.
• A log of who accessed which account and when.

Profiles per client

A browser keeps cookies, local storage, saved logins and extension data. When two clients' accounts are opened in the same profile, those leftovers connect them. Give each client a separate browser profile, and never sign in to two clients in one profile, even briefly.

At agency scale, antidetect browsers manage hundreds of isolated profiles, each with its own storage, fingerprint settings and proxy. The antidetect browser guide explains what they isolate. Set each profile's proxy once, to that client's line, and lock it so a staff member cannot switch it by mistake.

For mobile-first platforms, the same principle applies to devices: one phone or cloud phone per client, not one phone with every client's app logged in.

One line per client country

When every client account is opened from the agency office, every account shares the office IP. If one client account is restricted, the shared address is one more thing that connects it to the others.

A cleaner pattern is one dedicated line per client, in the country where that client's audience and accounts are. A Coronium line is one physical device with its own SIM, rented to one customer, so its carrier IP is not shared with other Coronium customers. It carries HTTP and SOCKS5 and changes IP only when you press the button, call the API, open the rotation link or set a timer. For account work, leave the timer off and keep the IP steady during working sessions.

How agencies usually size it:

• One line for each client whose accounts must stay separate from other clients.
• A second line in another country only when that client operates there.
• A spare line for testing ads and landing pages without touching client accounts.

Agencies that resell lines to their own clients can use the reseller program. Volume pricing is 10% off at 10 or more lines and 15% off at 25 or more, as a code on request.

Offboarding

Write the offboarding steps into the onboarding checklist, so access never outlives the contract:

1. Ask the client to remove partner, collaborator or team access on their side, and confirm it is gone.
2. Rotate every shared password and move two-factor codes to the client.
3. Delete the client's browser profiles and cloud phones after exporting anything the client owns.
4. Release or reassign the client's line. A replaced Coronium line comes with new credentials, so old configurations stop working.
5. Record the date and what was handed over.

The same checklist works when a staff member leaves: remove them from vault collections and partner roles first, then rotate what they knew.

Frequently asked questions