Key takeaways
- Never ask a client for their raw social media password.
- OAuth connect grants scoped, revocable access without exposing credentials.
- The client can revoke access at any time from their own platform settings.
- A hybrid connect model also supports staff-on-behalf access where a platform allows it.
Why password sharing is the wrong approach
A shared password gives you everything the client can do on that account, not just publishing — and it breaks the moment they change it, use two-factor authentication, or forget they shared it with three other vendors. It also leaves no record of who did what.
Connect through OAuth instead
- The client clicks "Connect" and signs in directly on the platform’s own login page — you never see or handle their password
- Access is scoped to what the connection actually grants (typically publishing and basic account info)
- The client can revoke access at any time from their own platform account settings, with no coordination needed from you
- If a client relationship ends, access simply stops when they revoke it — no password to reset
How SkedCast handles this
SkedCast supports hybrid connect: standard OAuth for most platforms, and staff-on-behalf access where a platform’s own API supports it for agency use. Every connected account sits inside a per-client, RBAC-isolated workspace, so one client’s team never sees another’s accounts. See client approval links for the related question of how a client signs off on content without an account.
agency operationsclient accesssecurityonboarding
FAQ
- Should I ever ask a client for their social media password?
- No. Use the platform’s own OAuth connect flow instead, which the client authorizes directly without sharing credentials with you.
- Can a client revoke my access later?
- Yes. Since access is granted through the platform’s own OAuth flow, the client can revoke it at any time from their own account settings, independent of any tool you use.
- What if I manage the account on the client’s behalf entirely?
- Some platforms support a staff-on-behalf or business-manager style connection for agency use, which still avoids sharing a personal password. Check what each platform’s API supports before falling back to credential sharing.