Table of Contents
How to Collect Client Credentials Securely (Without Using Email)
The Email Problem
If your agency collects client credentials over email, you are taking on significant risk. Email is not encrypted in transit between most providers. It gets forwarded, replied-to, archived, and accessed by people the original sender never intended. Credentials sent over email tend to stay in inboxes for years.
This is not a hypothetical concern. It is the most common way agency clients get compromised.
Access Grants vs Credentials: The Key Distinction
The best practice is to avoid collecting credentials at all.
Most platforms — Google, Meta, LinkedIn, HubSpot, and others — support access delegation. Your agency can be added as a user or partner with the appropriate permission level, without ever knowing the client's login details.
- Access grants — the client adds your agency email to their platform. You log in as yourself. No shared password.
- Credentials — the client shares their username and password. You log in as them. This is what to avoid.
Where access delegation is available, always use it.
Platforms That Support Access Delegation
- Google Analytics 4 — add users at account or property level (see how to get Google Analytics access)
- Google Search Console — add users as Owner, Full, or Restricted
- Meta Business Manager — add agency as a partner or add individual users (see how to get Facebook Ads access)
- Google Ads — link via Google MCC (My Client Centre)
- LinkedIn Campaign Manager — add account users
- Shopify — staff accounts with specific permission scopes
When You Cannot Avoid Credentials
Some legacy systems and bespoke CMS installs do not support user-based access. When credentials genuinely cannot be avoided:
Never accept them over email. Use a dedicated portal or encrypted sharing tool. The client shares credentials through a secure form; they are stored encrypted and never appear in an email thread.
Rotate passwords after handover. Once you have access set up internally, ask the client to change their password. That way the shared credential is no longer live.
Store credentials in a password manager. Use a team password manager (1Password, Bitwarden) rather than a spreadsheet or shared document.
The Secure Portal Approach
A client portal designed for onboarding handles this problem at the source. Clients grant access directly from within the portal using OAuth connections where supported, or submit sensitive information through encrypted forms where not. Nothing passes through email.
This also removes the back-and-forth: clients complete the process in one session rather than exchanging multiple emails over several days.
What to Tell Clients
Some clients will want to email credentials because it is the quickest thing they know how to do. A brief explanation helps:
"We do not collect login details over email for security reasons. We will send you a secure link where you can share access safely — it takes about five minutes."
Most clients appreciate that their security is being taken seriously. It is a professional differentiator, not a barrier.