How do I give my agency Facebook ad access without sharing my password?

Use Meta's Business settings instead of handing over your login. Either connect the agency's own Business account as a partner — you share only your ad account to their Business ID — or, for a solo freelancer, invite them by their work email and assign a specific role on specific assets. Both let them work under their own logins, keep you as the owner, and let you revoke access in seconds. You never share your password, and you never share a two-factor code.

What is the difference between partner access and adding a person?

Partner access is for an agency that runs its own Business account: you share your ad account to their Business ID, their whole team works under their own logins, and you can remove the partnership in one click when the work ends. Adding a person is for a freelancer or a staff member without their own Business account: you invite them individually and give them a role. Use partner access when the agency has its own Business account — it is cleaner to revoke and staff changes at their end never touch your account.

What ad account role should I give my agency?

Give the least they need to do the job. The advertiser / manage-campaigns level lets them build, edit, and run ads and read performance — right for most agencies and media buyers. The analyst / view-only level lets them see reports but change nothing — good for a reviewer. Admin has full control including billing, and at the business level can add or remove other people — so keep that inside your own business, almost never for an outside agency.

How do I remove an agency's access to my Facebook ads?

For a partner, open your Business settings, go to Partners, select the agency, and remove them. For a person you added, go to People, select them, and remove them from the asset or the business. Access ends immediately — no password reset, no locking yourself out. Meta moves and relabels these screens often, so if the menu names differ, reconfirm against Meta's Business Help Centre. Do it the day the engagement ends, not 'sometime later.'

Should I ever give my agency my Facebook password?

No. Your login controls your personal profile, your Pages, your payment methods, and every business you are connected to — with no record of who changed what and no clean way to take it back. A legitimate agency will ask for their Business ID so you can add them as a partner; it will not ask for your password or a code from your phone. If someone insists on your login, treat it as a reason to slow down.

How to Give Your Agency Facebook Ad Access — Without Sharing Your Password

The message usually comes over WhatsApp: "Chetta, just send your Facebook login and password, we'll set the ads up from our side." It feels like the fastest way to get moving. Don't do it. There is a built-in, safer way — from your Meta Business settings you either connect the agency's own Business account as a partner, or assign a role to a specific person — and you grant only the access they actually need. You stay the owner, you can see exactly what each party can touch, and you can cut them off in seconds the day the work ends. Sharing your password does the reverse: it hands over your whole account, hides what anyone changes, and can lock you out when things go wrong.

Because that one password is not just your ad account. It is your personal profile, the business Pages you manage, your saved payment methods, and every other business your account is connected to. Hand it to a contractor and you have given away all of it at once — with no record of who touched what, and no clean way to pull it back short of a password reset that logs you out too.

It gets worse with time, not better. Agencies change staff. The person you trusted leaves, the login keeps working, and now someone you have never met can spend your money. A villa builder in Kochi found this out the slow way: a freelancer who had left eight months earlier still had full access, and nobody had thought to check — because access had been a shared password, not a named seat you can see and remove. If your "ads person" asks for your login, that is the first thing to slow down on. The proper way takes about five minutes and gives away nothing you did not intend.

What are the two safe ways to grant access?

There are two legitimate methods, and which one you use depends on who you are working with:

Partner access — best when the agency runs its own Business account. You share your ad account (and your Page or dataset, only if they genuinely need them) to their Business ID. Their team members get in under their own logins; you remain the owner and can revoke the whole partnership in one click.
Add a person — best for a solo freelancer or a staff member with no Business account of their own. You invite them by their work email and assign a specific role on specific assets. They accept under their own account. Still no password shared.

If the agency has its own Business account, prefer partner access. It is cleaner to revoke, and their staff turnover never becomes your problem — you remove one partnership, not a dozen individual people.

How do I set up partner access?

The shape of the flow is steady even though Meta renames the menus regularly (if the wording differs from the below, look under Business settings for the equivalent, or reconfirm against Meta's Business Help Centre):

Open your Business settings (business.facebook.com), the settings for your own Business account.
Find Partners (under the Users group) and choose to share assets with a partner using their Business ID.
Ask the agency for their Business ID — a legitimate one will hand it over without hesitation — and paste it in.
Select the ad account (and Page or dataset only if needed) and set the access level for each. Grant the least that lets them do the job.
Confirm. Their team now works under their own logins, and you can remove the partner whenever you want.

How do I add a freelancer who has no Business account?

Same settings, a different door:

Open Business settings → People → Add. (Menu names shift; look under Business settings for the People or Users section if the label differs.)
Enter the person's work email and set a low business-level role.
Assign them to your ad account specifically, and choose the ad-account role (see the next question).
Meta emails them an invite and they accept under their own account. Done — and revocable anytime.

Note the email here is only how Meta delivers their invite to their login — it is not you sending anyone your credentials. Nothing about your password leaves your hands.

What role should I actually give them?

Give the minimum that lets them work. In plain terms:

Advertiser / manage campaigns — can create, edit, and run ads and read performance. This is the right level for most agencies and media buyers.
Analyst / view-only — can see reports but change nothing. Good for a reviewer, or a junior you want watching but not touching.
Admin — full control, including billing and finances, and at the business level the power to add or remove other people. Keep this inside your own business; almost no outside agency needs it.

Start lower than feels comfortable. You can always raise access in a minute; you rarely regret having granted too little. A study-abroad consultancy that gave its media buyer plain advertiser access — not admin — later swapped agencies in an afternoon, with no billing details exposed and nothing to untangle.

How do I remove their access when the work ends?

This is the whole reason to do it the right way. For a partner: Business settings → Partners → select the agency → remove. For a person you added: People → select them → remove from the asset or the business. Access ends immediately — no password reset, no collateral lockout, no drama. Do this the day an engagement ends, not "whenever I remember." An unused seat that still works is exactly the quiet gap someone walks through later.

What should I never hand over?

Never share your password, never read out a two-factor code from your phone, and never give full admin or owner control of your Business account to an outside party. A legitimate agency asks you for their Business ID so you can add them as a partner — it does not ask for your login or a code. If someone pushes for your password, or wants you to turn off two-factor "just to make setup easier," that is your signal to stop and rethink who you are handing your account to.

None of this makes your ads perform on its own — access is hygiene, not strategy, and the direction of the account stays yours. But it means the money, the settings, and the customer data are only ever touched by people you can see and remove. Under India's DPDP Act you are the one responsible for who holds that data; setting access up this way is how you keep that promise you can actually keep.