Three ways, and none of them needs the password. To give an agency access to an Instagram account without sharing the password, use Instagram's own Shared access for people who post and reply in the app, Meta Business Suite partner access for an agency running ads and content through a business portfolio, or a connect link from the agency's DM tool, which the creator opens and approves themselves.
Which one fits depends on what the agency is going to do. Posting and replying by hand is one job, running ads is another, and comment-to-DM automation is a third, and each of the three routes was built for one of them. This page takes them in turn: what each one gives the agency, what it keeps back, and how the creator takes access away again.
Why not just send the agency the password?
A password hands over the whole account at once, and the only way to take it back is to change it. Whoever holds it can read every DM, change the account's email and sign in from anywhere, and the creator has no way to limit any of that to the part of the job the agency was hired for.
It does not work well for the agency either. Twenty clients means twenty passwords to store safely, twenty sets of two-factor codes to ask for whenever Instagram wants one, and a lost afternoon every time a client changes theirs. Every route below exists so that nobody has to work that way.
What is Instagram's Shared access?
Shared access is Instagram's built-in way to let someone use an account without the password. The owner opens their profile, taps the menu, taps Shared access, then Invite people, and chooses who to invite. The invited person has seven days to accept, and can then post, like and comment on the account's behalf.
Three details from Instagram's help centre, read on 9 October 2026, matter to an agency:
- The inbox is a separate switch. Accepting an invitation does not open the account's DMs. The owner turns on inbox access person by person, and Instagram notes that it includes the account's chats with Meta AI. Story access is its own switch too.
- The owner sees what was done. Shared access keeps an activity record of the posts, comments, likes and follows each person made on the account.
- Not every account has it. Shared access is available to eligible accounts only, and not to teens. On a Meta One plan, Instagram sets how many people the account can invite: up to 4 on Advanced, 8 on Expert and 30 on Max.
Shared access is the right answer for a social media manager who posts and replies inside the Instagram app. It gives a person access, not a tool, so it does nothing for automation. What Instagram Shared access is keeps the short version, with the limits Meta sets on it.
How does Meta Business Suite partner access work?
Meta Business Suite lets a business share its assets with a partner, such as an agency, without any shared login. Both sides need a business portfolio in Meta Business Suite. The client opens Settings, then Partners, enters the agency's business portfolio ID, chooses which assets to share and how much access to give, and assigns them.
Meta offers two levels, according to its Business Help Centre, read on 9 October 2026. Full control lets the partner manage everything about the asset but never pass it on to another business. Partial access limits the agency to the tasks the client picks, such as creating content, managing ads or responding to messages. Only someone with full control of the client's business portfolio can add a partner, and Meta asks for two-factor authentication to be switched on first.
This is the route for an agency running paid ads, Facebook Pages and content calendars across Meta's own tools. It needs the client to have a business portfolio set up first, which is an extra step for a creator who has only ever used the Instagram app.
What about access tools like Leadsie, and the client links in social media suites?
Access tools and the client links built into social media suites package the same kind of access into one link the client opens. Leadsie, a tool built for agencies, sends one branded link through which a client grants manage or view-only access to their accounts on Meta, as a Business Manager partner, and on Google and other platforms. When we read its site on 12 October 2026, its Instagram integration was labelled "Coming Soon / Beta Access", and its plans started at $59 a month. Social media suites have their own versions: Vista Social includes a client connection link on its Scale plan, and Metricool on its Advanced plan.
These links are built for the jobs partner access covers: ads, Pages, content and scheduling. inDM connects through Instagram's own login, which only the account holder can approve, so partner access granted through one of these links does not connect inDM. That step is the connect link described below.
How does a DM automation tool get access without the password?
A DM automation tool built on Instagram's official API never sees a password. The account owner approves the tool on Instagram's own login screen, which lists the permissions the tool is asking for, and Instagram gives the tool those permissions and nothing more. A tool that asks for an Instagram password in its own form is not working this way, and that is reason enough to close the tab.
The catch for an agency is that whoever approves that screen has to be logged in as the client's account. Without a separate step for it, that left two options: the agency logs in with the creator's password, which is what everyone was trying to avoid, or the creator signs up for the tool and invites the agency in.
inDM's connect link gives that one step to the creator. Someone at the agency types the creator's handle in Settings and gets a link, then sends it however they already talk to that creator. The creator opens it on their own phone, logs in on Instagram's screen, approves, and the account appears in the agency's workspace. Five things keep it safe for both sides:
- The creator needs no inDM account. They never sign up, and they never see the rest of the agency's workspace or its other clients.
- One link, one handle. The link names the Instagram account it is for and refuses any other. If the creator's phone is signed into a different account, the page says which account Instagram used, the link is not used up, and the creator can try again.
- One use, seven days. A link works once and expires after seven days. Making a new link for the same handle switches the old one off.
- The page names who sent it. The creator sees who is asking before they approve anything, which is what a stranger asking for Instagram access should always have to show.
- It reconnects too. If Instagram ever disconnects the account, the agency sends a reconnect link instead of asking anyone for a login.
Connect a client's Instagram without the password walks through it step by step, with a screenshot of every screen the agency and the creator see.
What can the agency see and do once the account is connected?
The agency can set up automations on that account's posts, reels and stories, and read the conversations those automations start. The creator's page says exactly that before they approve, because reading conversations is the part a creator would most want to know about.
What the connection does not give the agency is the account itself. inDM cannot publish posts, reels or stories, change the profile, or sign in to Instagram as the creator. If the agency also posts for the client, that is a job for Shared access or Business Suite, alongside the connection rather than instead of it.
How does the creator take access back?
Every route can be undone by the creator alone. A connected tool is removed from Instagram's own settings, under Apps and websites, where every connected app is listed. Shared access is removed from the same Shared access screen it was granted from, and a Business Suite partner is removed in the client's Settings. None of the three needs the agency's cooperation.
Which route should an agency use?
Most agencies use two, because the jobs are different.
| The job | The route |
|---|---|
| Posting, replying and stories by hand in the Instagram app | Instagram's Shared access |
| Paid ads, Pages and content across Meta's tools | Meta Business Suite partner access |
| Access to ads and Meta assets for many clients, from one link | An access tool such as Leadsie |
| Comment-to-DM automation on a client's posts | The DM tool's connect step, approved by the creator |
A creator management agency running automations for twenty influencers does not need Shared access for that part of the work. Each creator opens one link, and the automations run from the agency's workspace.
The honest boundary: where connect links stop
- No permissions per client inside the agency. Everyone in an inDM workspace sees every connected account. An agency cannot give one teammate one client and hide the rest.
- One workspace per person. A person belongs to one inDM workspace. A creator who already runs their own inDM workspace cannot also join the agency's as a teammate, which is part of why connect links exist.
- No alert when a creator removes access. When a creator removes inDM in Instagram's settings, Instagram does not tell us, so the agency finds out when that account's automations stop sending.
- A Professional account is required. The Instagram account has to be a Business or Creator account, the same as on every tool built on the official API.
- The connect page is in English. inDM's own pages, the connect page included, are in English whatever language the creator writes in. Instagram's login screen, which is the step that matters, follows the language of the creator's phone.
- The plan still decides how many accounts join. Every plan can send a link, and the plan's account limit decides whether the account can join: one on Free, up to 5 on Growth, up to 15 on Agency Lite, and 30 on Agency Pro, then $3 a month for each one after.
What this changes for your next client
Nobody has to ask for a password again. Send the link with the welcome email, and the account is in your workspace before the kickoff call.
Instagram DM automation for agencies covers the rest of what an agency workspace includes, what DM automation costs an agency puts the plans side by side, and is it safe to connect Instagram to a tool explains what the official login screen lets any tool do, and what it never does. For the first week with a new client, setting up a new client's Instagram is the checklist, and what happens when a client leaves covers the other end.