Use case · agencies
Client account 2FA, for agencies
Social networks, ad platforms, online shops: centralise the 2FA codes of your clients' accounts, give access to whoever needs it and take it back when a freelancer leaves.
An agency signs in to its clients’ accounts every day: pages and ad managers, shops, analytics tools, hosting providers. Most of them require two-factor authentication, and the code lands on the phone of whoever set up the account, often a project manager, sometimes a freelancer who left long ago.
Where it breaks without a shared vault
- The campaign has to go out, and the only person with the code is in a meeting.
- A freelancer leaves the assignment with the seeds of three client accounts on their phone.
- The client asks who signed in to their account last week, and nobody can answer.
How Share Auth handles it
One vault, several roles. Client accounts live in the team’s vault. Project managers are editors, freelancers and interns are readers: they get the code without ever seeing the seed.
Departures without resets. Removing someone from the team cuts off their access. A reader never held a secret, so there is no 2FA to set up again on the client’s side.
An answer to give the client. The access log tells you who obtained the code for which account, and when. If a client asks who signed in to their account, you can tell them.
The code where the team works. With Slack or Discord, each client channel can be limited to that client’s accounts only.
Further reading
Frequently asked questions
It is not required. A single team for the agency is often enough, with per-channel restrictions if you use Slack or Discord. One team per client makes sense when the client has to pay for their own subscription or keep control: each team has its own plan and its own members.
Yes. With the reader role, they copy the current code without ever seeing the seed. At the end of the assignment, you remove them from the team and they are left with nothing.
The secret's edit page shows its setup QR code: the client scans it into their app, and you delete the secret from your vault.