Your agency has asked for access to Google Tag Manager. You don't need to share your password for it. Google Tag Manager lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against Google Tag Manager's own help pages in October 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. Publish is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| Publish | Edits tags, triggers and variables, creates versions and publishes them to your site. | Usually the right one |
| Approve | Edits and creates versions, but cannot publish. You publish each change. | If the work needs it |
| Edit | Creates workspaces and makes edits, but cannot create versions or publish. | If the work needs it |
| Read | Browses tags, triggers and variables without changing anything. | If the work needs it |
Add your agency to Google Tag Manager
- In Tag Manager, open your container and click Admin.
- In the Container column, click User Management, then click the add icon (+) and choose Add users.
- Enter your agency's email address, set Container permissions to Publish, then click Invite.
Adding users needs the Administrator permission on the Tag Manager account. The address you add needs to be a Google Account, and your agency accepts the invitation in Tag Manager.
How you both know it worked
Google Tag Manager emails your agency an invitation from google.com. Once they accept it, they show in your Google Tag Manager account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- Open your container, click Admin, then User Management in the Container column.
- Select your agency's email address, click Remove, then click Save.
Do you have to share your password?
No. Every step above uses Google Tag Manager's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one Get Set Keys link instead of a page like this. It walks the client through Google Tag Manager and the other platforms the project needs, and checks that each step is done.