Does your agency need your password? No.
Short answer: no. Platforms provide delegated access precisely so this is never necessary, and handing over credentials removes the one thing you cannot get back — the ability to lock someone out.
This page is what to use instead, and what to do if you have already shared a password.
What delegated access does
Co-manager or team access lets you grant someone specific permissions on your account without sharing a password. You choose what they can do, you can see that they have access, and you can revoke it in one click.
Crucially, revoking it does not require their cooperation. That asymmetry is the entire point.
What you lose by sharing a password
- The ability to remove access without a fight. Whoever holds the password can change it, and then you are in a support queue proving ownership of your own account.
- Any meaningful audit trail. Actions taken with your credentials are indistinguishable from actions taken by you.
- Control of payout details, which is the change that does the most damage fastest.
- Your platform’s protection. Sharing credentials usually breaches the terms, which weakens your position if you later need support to intervene.
Do this now, whatever your arrangement
- Turn on two-factor authentication, using an authenticator app rather than SMS. This alone prevents most account takeovers.
- Use an email address only you control for the account. An agency-controlled email is a password reset away from being an agency-controlled account.
- Check which sessions and delegated users currently have access, and remove anything you do not recognise.
- Confirm the payout details are yours and check them periodically. This is the field that gets changed quietly.
If you have already shared it
- Change the password now, and end all other active sessions.
- Change the account email if the agency controls it, then re-enable two-factor.
- Verify payout details have not been altered.
- Convert the relationship to delegated access with scoped permissions.
- If you are locked out, contact platform support with proof of identity and payout ownership. It is slow and often successful — but it is far worse than never having shared it.
The reasonable version of this arrangement
Plenty of agencies work properly: delegated access, a written contract, an exit clause, and payouts landing in the creator’s own account throughout.
None of that requires your password, and an agency that operates well will already know that. The request itself is the signal, not the answer that follows it.
Frequently asked
- What if the platform does not offer delegated access?
- The major ones do. If yours genuinely does not, that is a reason to reconsider the arrangement rather than a reason to share credentials.
- Is it different if it is a friend rather than an agency?
- The mechanics are identical, and so is the outcome if the relationship ends badly. Use delegated access with people you trust as well — it costs nothing and removes a category of problem entirely.
- They already have it and everything is fine. Should I change it?
- Yes, and it does not have to be a confrontation. "I am tightening up account security and moving everyone to co-manager access" is a normal, professional thing to say.
Related guides
The clauses that decide whether you can leave, who owns your audience, and where your money lands. What to look for before signing, and what to do if you already have.
Leaving badly is how creators lose their account, their audience or their earnings. The order of operations that protects all three.
Impersonation is constant in this industry and mostly handled badly. What works, what DMCA does and does not cover, and how to make yourself a harder target.