Handling a client's two-step verification codes as an agency team

Two-step verification asks for a second check after the password, usually a code sent to a registered phone or shown in an app. When a client’s account has it, the code goes only to the phone or app the client registered. If that is one person’s phone, everyone else on the team has to message that person for a code each time. There are two ways to cut that back. Move staff to their own access, and agree with the client on where codes go for any login that stays shared. The basics are in what is two-step verification?.

Second-step options and per-person access by platform

These are the options each platform’s help center lists.

X notes that text message codes for Premium subscribers may not be available in every country or with every carrier. Business portfolio access on Meta is covered in how Meta business portfolios handle agency access.

Every platform in the table lets staff work from their own accounts. So codes need to pass between people only when someone uses the owner’s login.

Moving staff to their own access

Once the client invites your staff through delegated access, codes stop changing hands. Each person signs in with their own account, and two-step verification is set on that account.

On X, the owner invites people as admins or contributors, and each accepts from their own X account. Under X Delegate, the owner alone controls the account’s password, phone number and two-step settings. On LinkedIn, Page roles go to LinkedIn members, and Campaign Manager requires each user to turn on two-step verification on their own LinkedIn account. On Google Ads, an invited user needs a Google Account of their own.

Google Ads manager accounts add one more control. Google’s developer documentation says admins of a manager account can require users of the accounts it owns to turn on 2-Step Verification. Linking an existing account doesn’t make your manager account its owner by default. An admin on the client account has to turn ownership on (see organizing agency access with a Google Ads manager account).

Platform terms point the same way. Section 3.1 of Meta’s Terms of Service covers Facebook. In it, users agree not to “share your password” or “give access to your Facebook account to others.” Section 3.2 adds that you may not “request, or collect” usernames or passwords. Instagram’s Terms of Use forbid trying to “solicit, collect, or use login credentials” of other users. X’s Delegate page encourages owners to change the password so that only they know it.

Google Ads has another reason. Its developer documentation says some advertisers may have to use a passkey to approve sensitive actions. A passkey signs you in with your device’s fingerprint, face or screen lock, and there is no code to read out to a colleague.

Logins that stay with the owner

Some accounts still need the owner’s login:

• Platforms with no way to invite people
• Tasks only the owner can do, such as changing X’s login verification settings
• Clients that can’t or won’t send invitations

Facebook and Instagram fall under the terms above, so plan to switch them to invitations. If the client can’t send invitations yet, agree on a date to switch. For X, keep the owner’s login for owner-only tasks. For whatever remains, choose where the codes go.

Codes go to the client’s phone, and you ask each time

The client’s settings stay as they are. The cost is that no one can sign in when the client’s contact is off or asleep. Codes travel to your agency by chat or phone, and nothing records who asked or who typed the code unless your side writes it down. This fits accounts you use rarely.

Codes go to a phone or email address your agency manages

Here the client changes the destination to a phone or email address your company manages. Don’t use one staff member’s personal phone, because no one can get codes after that person leaves. The account is the client’s, so the client decides whether to change it. Google Ads Help says changes to recovery information, such as a phone number, can take up to seven days to update across Google. You may see extra verification prompts in that time. Make the change well before any urgent work, and agree on how to change it back when the contract ends.

One authenticator app on several team phones

Some platforms allow it. Instagram, for example, recommends using an authentication app, such as Google Authenticator, because you can add more than one device to an account. It doesn’t address several people holding those devices. Adding the app to several team phones ends the code requests. But every phone shows the same code, so nothing records who signed in. You also have to set it up again whenever someone leaves.

Whichever you choose, decide how backup codes are handled. Facebook offers 10 recovery codes for when your phone isn’t available. X shows a backup code after you set up text message codes. Both work in place of the phone, so treat them with the same care.

What to agree with the client

For every login that stays with the owner, agree on these five points and add them to your list of client accounts.

1. Which accounts use the owner’s login, and why. This catches accounts that could move to invitations.
2. Where codes go, and who holds that phone or number. Then you know who changes it when that person leaves or moves.
3. How and when to ask for a change of destination. The client makes the change, and some platforms take days to apply it.
4. Where backup codes are kept, and who can see them.
5. How you record who used a code and when. The platform’s records are per account, so only your own record shows the person.

How to hand over code destinations at a staff change is in the account handover checklist.