Agency client onboarding checklist: getting access to Meta, Google Ads and LinkedIn the right way

Why an agency should never take a client's password

An agency should never take a client's password because Meta, Google Ads and LinkedIn each have a sharing model built for exactly this relationship, and a shared login defeats all three. The sharing models give the client three things a password cannot: the client keeps ownership of the asset, the client can end access on its own, and both sides can see who holds what.

Each platform's own help pages make the point in their own terms. Meta's partner-access guide asks the client to turn on two-factor authentication for its business portfolio before adding a partner, which only works if the agency never signs in as the client (Meta Business Help Centre). Google's access-levels page lists, as an admin-only ability, reviewing each user's authentication method and last login time, which is only informative when each person has a seat of their own (Google Ads Help). And LinkedIn assigns Campaign Manager roles to named members, so there is no password to hand over in the first place (LinkedIn Marketing Solutions Help).

The rest of this post is the checklist: the exact steps on each platform, the narrowest tier to ask for first, the three side by side, and the week-one order of operations. The steps are read from each platform's help pages on October 23, 2026; the platforms rename menus often, so the page is linked next to every step.

Meta: partner access through your business portfolio

Meta gives an agency access to a client's ad account, Facebook Page and Instagram account through partner access between two business portfolios, set up in Meta Business Suite. The client's portfolio shares the assets with the agency's portfolio; the agency then assigns its own people to those assets inside its own portfolio. Three facts from Meta's partner-access page shape everything else: only someone with full control of a portfolio can add partners, the agency must have a business portfolio of its own, and the client needs the agency's business portfolio ID to do it.

The request can start from either side.

1. The client gives access. In Meta Business Suite: Settings, then Partners under Users, then Add, then Give a partner access to your assets. The client enters the agency's business portfolio ID, chooses which assets to share and the level of access, and clicks Assign assets. Someone else with full control of the client's portfolio may need to approve it.
2. The agency asks. In the agency's own Meta Business Suite: Settings, then Partners, then Add, then Ask a partner to assign you their assets. The agency enters the client's email address and business portfolio ID, picks a role for each side, chooses the asset types and permissions it wants, and sends the request. The client can approve it, deny it, or change which assets and permissions to share, and the request shows under Partners until then (Meta Business Help Centre).

The level of access is the decision that matters. Meta offers two levels for a shared asset: full control, and partial access limited to specific tasks such as creating content, managing ads and responding to messages. A partner with full control can manage everything on the asset but cannot share it onward; only the owning portfolio can share an asset with another business. A partner with partial access can give its own people only the tasks it was itself assigned (Meta's permissions page). For a reporting-only engagement, partial access with the fewest tasks is the ask; full control is for an agency that runs the account.

Two more things from the same pages are worth knowing before the kickoff. Temporary access, which expires on its own after 3 to 75 days, exists for people added to a portfolio, not for partner businesses, so a freelancer can be time-boxed but a partner cannot. And removal is one menu: Settings, then Partners, then Options, then Remove from business portfolio, available to anyone with full control of the client's portfolio (Meta Business Help Centre). What a Meta reporting tool can then read through an agency seat is covered under Meta ads reporting for agencies.

Google Ads: linking the client account to your manager account

Google Ads gives an agency access to a client account through a manager account (MCC): the agency sends a link request from its manager account, and an admin on the client account accepts it. Google describes a manager account as an umbrella Google Ads account with individual accounts linked under it, from which the agency can view and manage every linked account with one sign-in (Google Ads Help). The client's own users keep signing in as before and cannot see the manager account or the other accounts linked to it.

1. Send the request. In the manager account, open the Accounts icon, then Sub-account settings, then the plus button, then Link existing account. Enter the client's Customer ID (one per line for several accounts), preview, and send. Users with access to the client account get an email (Google Ads Help).
2. The client accepts. An admin on the client account goes to Access and security under Admin, opens the Managers tab, and accepts under Link request; the email's Accept request button does the same. The agency receives a confirmation and the account appears under the manager account.
3. Decide on ownership. A client account can give a manager account ownership, which lets the manager account's admins edit the client account's user access, managers and product links. Without it, the manager account can manage campaigns but not who has access. Either way, Google says a manager account can never change a client account's sign-in information.

Access levels inside a Google Ads account are set per user, and the agency should know which one each of its people needs. The table below is the part of Google's access-levels page that matters for onboarding; read-only is enough for reporting, standard is needed to edit campaigns, and only admin can accept the manager link or unlink it later.

Three limits from the same pages belong in the checklist. Up to 20 Google Ads accounts, manager accounts included, can be associated with one email address, so an agency past that needs the manager account anyway. A manager account is required for monthly invoicing. And the client can end the relationship at any time: any user with administrative access to the client account can unlink it from the manager account. Google also notes that an account with a single administrator risks losing access to its tags if that person becomes unavailable, which is a reason to ask the client for a second admin on day one. What arrives through a linked account in a reporting tool is under Google Ads reporting for agencies.

LinkedIn: Page admin roles and Campaign Manager roles

LinkedIn splits agency access in two: admin roles on the client's LinkedIn Page, and user roles on the ad account in Campaign Manager. Some ad tasks need both, and the two are granted in different places by different people, which is where most LinkedIn onboarding stalls.

On the Page, LinkedIn offers three Page admin roles and three paid media admin roles, and a member can hold roles from both groups at once. To get any of them, a person either requests admin access or is granted it by an existing admin (LinkedIn Help).

• Super admin holds every Page permission, including adding and removing admins of any type, editing Page information and deactivating the Page.
• Content admin creates and manages Page content: posts, boosted posts and events.
• Analyst sees the Analytics tab only, and LinkedIn says analysts have limited access to the Page in third-party tools.
• Paid media admins are Sponsored Content poster (create Sponsored Content ads or sponsor organic posts from Campaign Manager), Lead Gen Forms manager and Landing Pages manager.

The permissions table settles which role a tool needs: posting content through third-party sites, boosting posts and creating Sponsored Content as the Page are super admin and content admin abilities; viewing and exporting analytics is open to all three. An agency that will publish to the Page from a scheduler therefore needs a content admin seat at least, and that is the role LinkedIn requires before any tool, overads included, can post as a Company Page (how overads posts as a Company Page the member administers is on the LinkedIn channel page).

On the ad account, Campaign Manager has five user roles. Every ad account must have a billing admin, and the person who creates the account gets that role automatically (LinkedIn Marketing Solutions Help).

Adding the agency is the client's account manager's job: in Campaign Manager, Account Settings, then Manage access, then Add user, then the person's name or profile URL and a role. Two constraints apply. The account manager can only add members who are 1st, 2nd or 3rd-degree connections, and if the ad account has been claimed into LinkedIn Business Manager, access is managed there instead of in Campaign Manager (LinkedIn Marketing Solutions Help). LinkedIn recommends more than one account manager per ad account.

The two halves meet on Sponsored Content. Creating ads in Campaign Manager also needs a Page role: super admin, content admin or Sponsored Content poster on the Page the ad account is associated with, and Sponsored Content poster can only be assigned by a Page super admin, through the Page or by email, never from inside Campaign Manager (LinkedIn Marketing Solutions Help). An agency that gets a Campaign Manager role but no Page role can read the account and cannot create a Sponsored Content ad.

The three platforms side by side

The three platforms solve the same seven questions in three different vocabularies, and the table below puts them on one axis. It is built from the help pages linked above, read on October 23, 2026, and nothing in it is from memory.

Two rows deserve a second look. The narrowest tier is not the same kind of thing on each platform: Google's read-only and LinkedIn's viewer are reading tiers, while Meta's partial access is a task list that can include managing ads, so an agency asking for partial access should name the tasks it wants and no more. And only on Meta can the agency start the request itself; on Google Ads the agency starts but the client must accept, and on LinkedIn everything is done by the client's admins, so the LinkedIn step is the one to brief the client on most carefully.

The week-one onboarding checklist

A week-one onboarding checklist for an agency puts the asks in the order the platforms need them, so the client does each thing once. In order:

1. Send your identifiers before the kickoff. Your Meta business portfolio ID, your Google Ads manager account Customer ID, and the LinkedIn profile URLs of each person who needs a Page or ad account role. Ask the client for its Google Ads Customer ID and, on LinkedIn, the name of the Page super admin and the ad account's account manager.
2. Confirm who holds the keys on the client side. Meta needs someone with full control of the client's portfolio; Google Ads needs an admin on the account; LinkedIn needs a Page super admin and an ad account account manager. If any of those is one person, ask for a second one now, for the reasons each platform gives: Google's single-admin tag warning, LinkedIn's recommendation of more than one account manager, Meta's request process for a portfolio nobody controls.
3. Ask for the narrowest tier the brief needs. Partial access with named tasks on Meta, read-only on Google Ads, analyst and viewer on LinkedIn for a reporting engagement; full control, standard and content admin plus campaign manager when the agency will run the account. Widen later; narrowing after the fact is the harder conversation.
4. Make the requests, in the order the platforms allow. Send the Meta partner request and the Google Ads link request from your own accounts the same day; send the client the LinkedIn steps with the help-page links, since only its admins can act there. Watch for the Meta approval, the Google confirmation email and the LinkedIn roles appearing.
5. Record what was granted. Asset, tier, who granted it, the date, and the date it should end. Put the removal steps from the table above into the contract, so offboarding is a lookup, not a negotiation.
6. Connect tools from agency seats, never the client's login. A reporting tool connected from a named agency seat inherits that seat's tier and nothing more; which permissions a tool asks for, and why read-only is enforceable on some platforms and only promised on others, is in what ads_read and ads_management allow.
7. Agree the approval chain before the first post or change. Who at the client signs off, on what, and within how long. The platforms do not model this; the agency's tools have to. How a scheduled post can wait for a person's approval is in the scheduling and approvals guide.
8. Rehearse the exit. Open the three removal paths once while access is fresh, so that on the last day of the contract the client can end access in minutes and the agency can confirm it is gone.

Where overads fits

overads is built for the one-workspace-per-client shape this checklist assumes: each client is its own workspace with its own connected accounts, team, brand profile and approval rules, and the agency switches between them from one login (overads for agencies). Seats and connected ad accounts are not counted, so a viewer seat for the client costs nothing extra.

For publishing channels, a client does not need an overads login at all. An agency key with the workspaces:manage scope creates the client workspace and mints a hosted connect link; the page behind it shows the agency's name and logo and one tile per channel, and the client signs in to each platform with the platform's own login, so the tokens land in the client's workspace and the agency never sees a credential. Read from the code on October 23, 2026: a link lives 7 days by default and 90 at most, the link is the only credential and grants reading that page and connecting channels and nothing else, minting a new link with rotate revokes every earlier one, and detaching the client workspace revokes them all (managed workspaces guide). The hosted page covers publishing channels only: Instagram, Facebook, LinkedIn, X, Bluesky, Mastodon and Pinterest today, with channels still in platform review marked as such.

Ad accounts connect inside the app, by a workspace member, with the platform's own sign-in, and what arrives depends on the platform. Meta Ads connects through Facebook Login asking for ads_read; overads also requests ads_management, which Meta declined at App Review on July 28, 2026 and now drops for everyone except the app's own admins, developers and testers, so a customer connection reads and cannot change ads. Which ad accounts to import is picked in overads after the sign-in, and the pick is limited to the accounts the Meta seat can reach, which is where the partner access above comes in. Google Ads connects with Google's adwords scope, and overads lists the accounts the signed-in Google user can reach and then walks every enabled client account beneath each of them, so an agency seat on a manager account reaches every linked child account without connecting each one. Snapchat Ads arrives as account-level spend only. Meta and Google sync the full campaign, ad set and ad structure with daily numbers.

For the client's own view, there are three options and none requires giving the client an agency seat: a viewer seat in the workspace, which the product describes as seeing everything and changing nothing; a client portal link, emailed to a contact, read-only, valid for 30 days and revocable from Settings; and client approval, where a scheduled post waits for the client to approve it from an email, either on its own or after someone on the agency team has approved first.

What overads does not do, and when another tool fits better:

• overads does not request or grant platform access for you. The Meta partner request, the Google Ads link request and the LinkedIn roles still happen on the platforms, by the people named above; overads connects to what those grants already allow.
• overads does not change ads. On every ad platform it reads and proposes; a person applies the change in the platform. An agency that wants a tool to pause, launch or rebudget needs one that holds write access, and on Meta that means an app Meta has approved for ads_management.
• LinkedIn Ads and X Ads data does not arrive in overads yet. The LinkedIn connector waits on Marketing Developer Platform approval for the r_ads and r_ads_reporting scopes, so LinkedIn Ads is not offered on the connect screen and LinkedIn ad reporting stays in Campaign Manager for now; X Ads is not offered to customers yet, because the X connection is still being verified on a real account before it is switched on. LinkedIn Page publishing is live, as the signed-in member or as a Company Page the member administers.
• The hosted connect link does not cover ad accounts. A client who should connect its own Meta or Google Ads account does that as a member of the client workspace, not from the link.
• overads keeps no copy of the client's password or the platform access itself. If the client removes the partner, unlinks the manager or drops the Page role, the connection in overads stops reading with it, which is the point.