setscale

Client account access for agencies: the go live checklist

September 10, 2026·13 min read
Woman around thirty with dark curly hair tied back and a rust coloured knit cardigan, sitting at a warm oak desk in a small agency office with a green plant and an open notebook, reviewing an account checklist on a laptop in soft window light

Client account access for agencies is the step that decides whether a signed contract becomes a working inbox. It is also the step most agencies discover late, on the morning they promised the client that setting starts, when the messages simply do not arrive.

This is written for the person who owns the account, not the conversation: agency owner, head of sales, ops manager. It assumes you run several client accounts at once, that each client is a different company with a different administrator, and that nobody on your team should ever be holding a client password. The technical facts below come from Meta's own developer documentation, consulted on 10 September 2026 and linked at each point, because the interface wording changes faster than any blog post.

TL;DR

  • Access is not one permission. It is three layers: the business asset, the task on the page, and a toggle inside the client's own Instagram settings.
  • The toggle is the one that fails silently. Everything looks granted, and the inbox stays empty.
  • A password is not access. It breaks two factor authentication, it cannot be revoked cleanly, and it makes an account impossible to audit.
  • Request access as a written document with named owners and a deadline, not as a message in a group chat.
  • Verify by sending a real message from an outside account before you tell the client the account is live.

Table of contents

What client account access for agencies actually means

Client account access for agencies means your team can read and answer a client's messages, from your own identity, with a permission the client can withdraw in one click. Three properties matter in that sentence: from your own identity, so every reply is attributable to a named person; with a permission the client controls, so leaving is clean; and without a shared credential, so the client's security does not depend on your team's discipline.

Everything else people call access fails one of those three. A shared password fails all three at once. It defeats the client's two factor authentication, it survives the departure of the employee who used it, and when three setters reply from the same login you lose the one thing your quality assurance across accounts depends on, which is knowing who wrote what.

The three layers that decide whether the inbox opens

Most onboarding delays come from treating access as a single yes. It is three separate yeses, and they are granted in three different places by potentially three different people.

Layer one, the business asset. The client's account belongs to a business portfolio. Your agency is added as a partner and receives access to specific assets rather than to the whole business. Meta documents this path on its help page for giving a partner access to business assets, and the exact click path there changes often enough that it is the page to follow, not a screenshot in a slide deck.

Layer two, the task. Being added is not the same as being allowed to do something. Meta's Instagram Platform overview lists messaging as its own task, named PROFILE_PLUS_MESSAGING in the API, tied to the instagram_basic and instagram_manage_messages permissions. An administrator who grants you content publishing has not granted you the inbox.

Layer three, the account toggle. This one lives inside the client's Instagram app, not in any business interface, and no agency dashboard will show you that it is missing. It is covered below.

What to request, from whom, and what it unblocks

The table is the artefact worth copying into your onboarding document. The right hand column is the part agencies skip, and it is the reason a go live slips by a week.

What you request Who can grant it What it unblocks How you verify it
Partner access to the business portfolio The client's business administrator Your agency exists in their account structure Your own business settings list the client's assets
The messaging task on the account The same administrator, per asset Reading and answering direct messages Your tool completes its connection without an error
A professional account on Instagram Whoever holds the Instagram login Any API access at all The account settings show a professional account
The link between the Instagram account and the page The page administrator The Facebook login path, when you use it The page settings show the linked account
The connected tools toggle The person with the Instagram app on their phone Messages actually reaching your tool A test message from an outside account arrives

Notice how often the answer to "who can grant it" is a different human being. The marketing manager who signed your contract rarely holds all five. Ask for the names on day one, in writing, and you convert a week of chasing into a single meeting.

Instagram login or Facebook login changes your request

Meta's documentation describes two configurations, and which one your tool uses changes what you have to ask the client for. In the first, "your app serves Instagram professional accounts with a presence on Instagram only" and users log in with their Instagram credentials. In the second, "your app serves Instagram professional accounts that are linked to a Facebook Page" and users log in with Facebook credentials, which means the page link becomes a hard prerequisite rather than a detail.

One requirement is common to both. As Meta states it: "To use the APIs, your app users must have an Instagram professional account." A client running a personal account has to convert before anything else on your checklist can happen, and that conversion is their decision, not yours. Put it first in the sequence for exactly that reason.

The permissions your tool will ask for, in plain words

When the client clicks through the connection screen, they see permission names that look alarming and explain nothing. Being able to translate them on a call is worth more than any reassurance you can offer.

Meta's get started guide for Instagram messaging lists what the app requests: instagram_basic, instagram_manage_messages and pages_manage_metadata. In plain words, the first identifies the account, the second is the inbox itself, and the third handles the technical subscription that lets new messages be delivered to the tool rather than sit unread. The same guide also notes that the account granting access needs to be able to perform the MODERATE task on the connected page.

Say that out loud during onboarding. Clients refuse connection screens they do not understand, and a refusal at that moment costs you the week you had planned to spend booking calls.

Connected tools, the toggle that fails silently

This is the item that turns a smooth onboarding into a support thread. Meta's get started guide states that "Instagram professional accounts will need to enable the connected tools toggle under message controls settings", reached through Instagram settings, then messages and story replies, then message controls, then connected tools, then allow access to messages.

Read where that lives: inside the Instagram app, under the client's own account. Not in the business portfolio, not in any partner screen you can see. Which produces the failure every agency recognises. The client's administrator grants everything you asked for, your dashboard shows the account as connected, and the inbox stays empty. Nobody has done anything wrong, and nobody can see what is missing.

Two habits fix it permanently. Put the toggle on the client side of your checklist with the exact path written out, because the person who has to tap it is often not the person you have been emailing. And make your verification a real inbound message rather than a green status indicator, which is the subject of a section below.

Why the 24 hour window changes what day one means

The messaging rules also shape what your first day can actually look like. Meta's messaging API documentation states plainly: "Your app has 24 hours to respond to any message sent from an Instagram user to your app user." The same page notes that only after a user has messaged the account can your app message that user.

Two consequences for onboarding. First, there is no backlog to import: conversations older than the window are not a starting point, so a promise to "clear the backlog on day one" is a promise you cannot keep. Second, the clock starts the moment access lands, which is why your response time SLA and your coverage rota need to be agreed before access, not after. An account that goes live on a Friday afternoon with nobody rostered has already spent its first window.

Write the access request as a document, not a message

The single change with the highest return in onboarding is to stop asking for access in a chat thread. A document survives holidays, staff changes and the client's own internal handover. It contains six things and nothing else:

  • The list of accounts in scope, named exactly as they appear in the client's business portfolio.
  • The five requests from the table above, each with the name and email of the person expected to grant it.
  • The connected tools path, written as steps, for the person holding the phone.
  • What your team will and will not be able to see, stated explicitly. This is the paragraph that unblocks nervous clients.
  • The date access is needed and the date setting starts, which are deliberately not the same date.
  • How the client withdraws access, in one sentence. Saying it up front removes more objections than any assurance about your security posture.

Keep the document identical across clients. Onboarding that varies per client is onboarding you cannot delegate, and an agency that cannot delegate onboarding cannot add accounts without adding stress. The same logic applies to your white label offering, where the client sees your brand and the underlying access model still has to be clean.

The verification you run before you tell the client

A connected status is a claim about a configuration. It is not evidence that a message arrives. Run the same four checks on every account, from a device that is not signed in to anything of yours:

  1. Send a message to the client's account from an outside personal account. It should appear in your tool within seconds.
  2. Answer from your tool, and confirm the reply is visible on the outside device.
  3. Check that the reply is attributed to the account owner and that your internal log shows which of your people sent it.
  4. Book a test appointment through the whole path, so the routing to the calendar and the write to your CRM are proven before a real lead depends on them.

Four minutes per account. It is the difference between discovering a broken configuration yourself and having the client discover it, which is the same technical event with an entirely different commercial outcome.

What to do when the client will not grant access

Some clients say no, and the refusal is usually reasonable. Three patterns, three answers.

The client has been burned before, often by an agency that kept access after the relationship ended. Answer with the revocation path in writing and a scope limited to messaging, not to the whole business.

The client cannot find the administrator, because the account was set up by a former employee or an old contractor. This is common and it is slow. Treat it as a project with its own owner and its own deadline, and never let it silently push the start date.

The client is willing but wants to keep answering some conversations personally. That is workable and worth designing rather than resisting, but it needs an explicit split written into the qualification rules so two people never answer the same prospect.

Where SetScale fits

SetScale is an AI setter built for teams and agencies rather than for a single inbox: several client accounts, several closers, reporting per seat, with a white label option planned. That shape is exactly why access is treated as a first class part of the operation here, not as a support ticket. The infrastructure view of setting is the wider argument, and the account level playbooks are covered in running several client accounts and in what to report back to each client.

The product is not open yet. The only thing on offer today is the waitlist, and it is worth joining if you would rather that account setup, routing and reporting arrive as one operation. Join the waitlist.

FAQ

Is a password ever acceptable, even temporarily?

No, and the temporary version is the dangerous one because nothing is more permanent. It defeats the client's two factor authentication, it cannot be revoked without a password change that locks out everyone, and it makes per person attribution impossible. When the client offers, decline and send the access document instead.

How long should onboarding access realistically take?

Plan two working days when the administrator is identified and available, and a week when they are not. The delay is almost never technical. It is finding the human being who holds the account, which is why the names go in the document on day one.

What happens to access when a client leaves?

They revoke partner access on their side and the connection ends. Confirm it rather than assume it, remove the account from your own tools the same day, and export whatever reporting your contract entitles you to keep before the connection closes.

Does the same checklist apply to Messenger and WhatsApp?

The layers are the same, the details are not. Messenger runs through the page, which our Messenger page covers, and WhatsApp has its own number and template constraints that we treat separately in the WhatsApp setup for a team. Do not assume one grant covers all three channels.

Should access be billed as part of onboarding?

Whether you bill it or not, cost it. Two working days of an ops person per account is a real number, and it belongs in the same calculation as the rest of your cost per booked call and the wider comparison of the three routes.

Conclusion

Client account access for agencies is not an administrative formality before the real work. It is the first operational deliverable your client experiences, and it is the one that decides whether the calendar fills in week one or week three. Three layers, five requests, one toggle, one real test message.

Write the document this week, run the four checks on the next account you onboard, and note where it stalls. Meta's documentation is the source to check each time, since the Instagram Platform changelog carries a dated entry every few weeks, the most recent one at the time of writing dated 22 June 2026. If you would rather the access, the conversation and the calendar arrive as one system across every account you run, Join the waitlist.