Social Media Client Onboarding: Facebook Without Passwords

Almost every new client relationship hits the same awkward moment in week one: "Can you send me your Facebook login?" The client hesitates, then emails it, texts it, or reads it out over the phone. Two days later a login code lands on their phone at 7am and they forward it to you with a question mark.

That moment costs more than it seems. Meta's terms ask people not to share their password or give others access to their account. A login from a new device in a new city triggers security checks. And the password now lives in your inbox, your team's shared sheet and maybe a former contractor's laptop. If anything odd ever happens on that account, you are the first suspect.

Nearly everything a social media manager does on Facebook has a password-free route. This guide maps each kind of access to the right method, walks through social media client onboarding from signed contract to first post, and gives you the emails to send.

Why Shouldn't You Ask a Client for Their Facebook Password? #

Because it goes against Meta's terms, triggers security checks, and makes you answerable for everything that happens on the account. Meta asks users not to share their password or give others access to their account. Role-based access and client-connected tools give you everything the job needs without ever holding the keys.

Beyond the rules, there are practical reasons:

• Security. Every copy of a password is a way in. Shared sheets get forwarded, and staff leave.
• Login friction. Each time you log in from your office, the client may get a code, an alert or a locked account. Onboarding stalls for days.
• Liability. With a shared password, nobody can tell who did what. With roles, every action belongs to a named person.
• Trust. A client who never has to hand over their login starts the relationship feeling safe, which shows up at renewal time.

Source: Meta Terms of Service, section 3.1, effective January 1, 2025.

What Facebook Access Does a Social Media Manager Actually Need? #

Only the access the work requires. Page posting and ads need Page and ad account access in Meta Business Suite. Running a group the client owns needs an admin or moderator role on your own profile. Posting into groups the client joined, from their personal profile, needs their own logged-in browser, because Meta has no way to delegate a personal profile.

Meta renames menus often, so link the client to Meta's current help article rather than an old screenshot.

The last row is the one that used to send agencies back to asking for passwords. Group posts come from a member's personal profile, and Facebook allows one personal profile per person. There is no Page-style role for a personal profile, and since April 22, 2024 there has been no API route into groups either, after Meta removed group publishing from its Graph API. For an owner who wants to post as themselves in the town groups they have joined, the only password-free answer is software that runs in the owner's own browser.

Source: Meta Graph API v19.0 changelog.

What Does a Password-Free Onboarding Process Look Like? #

Six steps over about a week: a signed agreement, a kickoff questionnaire, one access request email, Meta Business Suite access, a group audit, and a connect link for group posting. Nothing in the sequence needs a password, and the client's part fits into one short sitting at their own computer.

1. Agreement. Put the access policy in the contract: "Access is granted through Meta's role-based tools and client-connected software. The agency will never request your passwords."
2. Kickoff questionnaire. Cover the offers worth promoting, service area, tone, topics to avoid, who approves posts and how fast, and which team members will post from their own accounts.
3. Access request email. One email listing exactly what you need and why (template below).
4. Meta Business Suite access. The client adds your agency as a partner for the Page, ad account and Instagram.
5. Group audit. Send a list of 20 to 60 groups for the client to join from their own account, with suggested answers to screening questions. Our guide to finding Facebook groups for marketing covers how to build that list.
6. Connect the posting account. The client opens your connect link and clicks Connect. Their joined groups appear in your dashboard.

Then approve the first month's calendar and go live. A month of posts planned in advance, using a Facebook group content calendar, gives the client something concrete to say yes to on day one.

The access request email #

"Hi Dana, thanks for signing on. To get started we need three things, and none of them involve your password. 1) In Meta Business Suite, add Northside Social as a partner on your Page and ad account (Meta's guide is linked here, about five minutes). 2) Join the groups on the attached list from your own Facebook account; some will ask a question, and we've suggested answers. 3) Open the connect link we'll email you, on the computer you use for Facebook, and click Connect. That lets us schedule posts into those groups for you. You can remove any of this access whenever you like."

How Do You Connect a Client's Facebook Account for Group Posting Without Their Password? #

Send a connect link the client opens on their own computer. With PilotPoster Agency, the client opens your branded link in Chrome, installs the PilotPoster extension, checks they are logged in to Facebook, and clicks Connect. Their password never leaves their browser, and you manage their posting from your agency dashboard.

In the Agency dashboard, choose Add account, then "Send to a client." Enter the account name and, optionally, the client's email, and PilotPoster emails the link for you, or you copy it and send it yourself. Each link works once and expires after 14 days, so an old email forwarded around the office cannot connect the wrong account months later.

The client sees a page with your agency's name, logo and colour, not a stranger's software. It walks them through three steps, confirms which Facebook account it found so they can switch if it is the wrong one, and tells them in plain words that their password never leaves their browser. Once they click Connect, their joined groups sync automatically and the account appears on your overview with its online status.

When to connect an account yourself #

The second option, "Connect it myself," is for accounts that run on computers your agency manages: your own team members' accounts, or a staff member who posts from the office. Open the link in a Chrome profile where that Facebook account is logged in, with one Chrome profile per account. Our guide to Chrome profiles for multiple Facebook accounts covers the setup. For client accounts, the client's own computer is the right default.

Agree on the posting computer up front #

Posts go out from each account's own browser, so the PilotPoster tab needs to be open in that Chrome. Ask the client which computer they will use: a front desk PC that stays on during business hours is ideal. If the computer is off, scheduled posts simply wait and go out when it is back. Your daily digest email lists any accounts that are offline, so you can nudge the client the same morning.

What Should You Tell a Client Before They Click Connect? #

Tell them what they are installing, what you will do with it, and how to switch it off. Clients who understand the connection in plain language connect faster, and they do not panic when a post appears in a group under their name.

"You'll install PilotPoster, the software we use to schedule your posts into Facebook groups. It runs in your own Chrome, so your Facebook password stays on your computer and we never see it. We'll schedule the posts we agreed on into the groups you joined, and every post shows up in your client portal with a link to it. Keep the PilotPoster tab open on this computer during the day. If you ever want to stop, disconnect from your portal or remove the extension."

Send that with the connect link. It answers the three questions every owner has: is it safe, what will you post, and can I stop it.

How Do You Show Clients What Is Posting on Their Account? #

Give them a view they can check without asking you. With PilotPoster Agency, each client can have an optional read-only portal, branded with your agency name, logo and colour, showing coming-up posts, recently published posts with live links, and 30-day results: posts live, groups reached and success rate.

Turn it on during onboarding, not after the first complaint. An owner who can see next Tuesday's post before it goes out feels in control of their own account, which is exactly the feeling a password request takes away.

What Goes on a Social Media Client Onboarding Checklist? #

Every access item, who owns it, and what "done" looks like, from the signed contract to the client opening their portal for the first time. A shared checklist stops onboarding drifting into week three and shows the client exactly which steps are theirs.

What Does Offboarding Look Like Without Passwords? #

Short and clean. The client removes your partner access in Meta Business Suite, removes you as a group admin if you had that role, and disconnects the posting account from their portal or by removing the extension. There is no password to change and no shared sheet to clean up.

A tidy exit is also good business. A client who leaves with nothing to clean up is far more likely to come back, or to name you when a friend asks who runs their Facebook.

Frequently Asked Questions #

How do I give a social media manager access to my Facebook Page without my password? #

Use Page access in your Page settings, or add their agency as a partner in Meta Business Suite and choose which tasks they can do. They log in as themselves, and you can remove the access at any time.

Can a social media manager post in Facebook groups for me? #

Yes, from your own account, through software that runs in your browser. With PilotPoster Agency you open a connect link, click Connect, and your manager schedules posts into the groups you have joined. Your password never leaves your computer.

Is it safe to connect my Facebook account to an agency's posting software? #

It is far safer than sharing a password. The connection runs in your own Chrome, the agency never sees your login, posts go out at a human pace, and you can disconnect from your portal or by removing the extension.

What should a social media client onboarding questionnaire include? #

The offers worth promoting, the service area, tone and topics to avoid, who approves posts and how quickly, which team members will post, and how the business tracks where new customers come from.

How long does social media client onboarding take? #

About a week when access is password-free. The slowest step is usually group admins approving join requests, so send the group list on day one.

Related Reading #

• Facebook Group Marketing for Agencies: Sell It as a Service
• How to Manage Multiple Facebook Accounts
• How Not to Get Banned Posting to Facebook Groups (2026)
• Is Auto Posting to Facebook Groups Safe in 2026?
• How Does PilotPoster Work? A Complete Walkthrough