Freelancers need a repeatable process
Freelancers and small agencies exchange credentials constantly: hosting logins, CMS admin accounts, API keys, database access, exports full of customer data. With several clients at once, a repeatable process saves time and avoids the classic mistakes, such as a password posted in the wrong client's thread or access that's never removed when the project ends.
Getting credentials from a client
Clients often don't know how to send credentials safely, so make the safe way the easy way.
- Ask for your own account first. Most hosting, CMS, analytics and code platforms can invite a collaborator. That's better for both of you: the client can remove you later without changing their own password.
- If they must send a password, send them a secret request. They paste the credential into the link you sent, and it's encrypted in their browser to a key only your inbox link holds. One answer is accepted, and opening it deletes it from the server, so copy it into your password manager when you read it.
- Keep client credentials in your password manager, in a separate vault or folder per client.
Sending credentials to a client
When you hand over something you created, such as a new admin account or a deployment key:
- Send it through a one-time secure note, or an EnvShare link for keys and config, with a short expiry.
- For important accounts, choose Link + password and give the password on a call.
- For documents such as contracts or exports with personal data, use an encrypted file drop rather than an email attachment.
- Ask the client to change the password after they sign in, so they hold a credential you never saw.
Ending a project cleanly
Offboarding is where freelancer access most often lingers. At the end of each engagement:
- ask the client to remove your accounts, or remove yourself where you can;
- rotate any shared credentials you knew, or ask the client to;
- delete the client's credentials from your password manager once you no longer need them;
- check My links for anything still unopened and revoke it.
Why this helps your business
A clear process is easy to explain in an onboarding email, reassures clients who care about security, and keeps sensitive data out of long email threads that outlive the project. It protects you too: if a client's account is misused later, you can show that your access was scoped, documented and removed on time.
For specific credentials, see how to send API keys safely and how to share database credentials safely.