The client access checklist for web and app agency kickoffs

Most access trouble on a new project starts with the first request: a list of platforms, a vague "admin access to the website" and no date. Every platform below lets the client invite you under your own name, so nobody needs to share a password. Here is what to ask for in each area, what the client must start early, and how to send it as one request. Names below match each platform's help pages at the time of writing. When the project ends, the handover checklist runs it in reverse.

The checklist, area by area

The owner's password is the wrong ask everywhere, so the "Not this" lines below cover the subtler overreach: a role bigger than the job.

Domain and DNS

• Ask for: access at the company that hosts the DNS, which is wherever the nameservers point and can differ from the registrar (Namecheap). GoDaddy: a delegate invite with Domains Only access. Namecheap: Share Access on that domain (you need your own Namecheap account). Cloudflare: a member invite with the Domain DNS role for that domain (Cloudflare).
• Not this: GoDaddy's Transfer Access, every Namecheap setting, or Cloudflare's Super Administrator role.
• Before kickoff: look up the nameservers yourself so you ask the right company, and check the domain hasn't expired, since Namecheap can't share an expired one.

Exact clicks: GoDaddy, Namecheap, Cloudflare. The registrar guide compares all three.

Hosting and the CMS

• Ask for: a hosting user and a separate WordPress user. WP Engine: Partial (no billing) for your environments. Kinsta: Site administrator, or Site developer for staging only. WordPress: Administrator in your name if you manage plugins and themes, Editor for content only.
• Not this: WP Engine's Owner role, Kinsta's Company Owner, or the client's own WordPress admin account.
• Before kickoff: nothing, but a WP Engine invite doesn't automatically add you to WordPress, so ask for both at once.

More in WordPress hosting access. Other builders and hosts: Webflow, Vercel, Netlify.

App stores

• Ask for: App Manager in App Store Connect, which covers pricing, App Store information, and development and delivery. Add access to Certificates, Identifiers & Profiles only if you sign builds, since it also shows you every app in the account (Apple). In Play Console, app permissions on the client's app only, such as Release to production, exclude devices, and use Play App Signing, Release apps to testing tracks and Manage store presence (Play Console Help).
• Not this: Apple's Account Holder role, which belongs to someone at the client who can sign Apple's agreements, or Play's Admin (all permissions) for the whole account.
• Before kickoff: the client needs its own developer accounts, and this is the slow part.
  • Apple, as an organization: a legal entity (no DBAs or trade names), a D-U-N-S Number, an Account Holder with legal binding authority, a work email and a public website on the company domain, and 99 USD a year (Apple). Apple won't accept a site showing a domain registrar's message, so if you're building their first site, plan for that.
  • Google Play: a US$25 one-time fee and identity verification, plus a D-U-N-S number for an organization account. Personal accounts created after November 13, 2023 need a closed test with at least 12 testers, opted in for 14 days in a row, before production (Play Console Help).

Guides: App Store Connect, Apple organization enrollment, Google Play. Exact clicks: App Store Connect, Google Play.

Payments

• Ask for: the Developer role, added from Stripe's Team settings with Add member. It can create API keys but can't invite team members (Stripe).
• Not this: secret keys sent by email or chat. Stripe says to share them only through secret-management tools (Stripe).
• Before kickoff: the client opens the account in the business's name. You can build in a sandbox now, but live payments wait for the client's business verification.

More in Stripe roles for agencies and the Stripe steps.

Code

• Ask for: a repository in a GitHub organization the client owns, with you as a collaborator on the Write role (GitHub).
• Not this: owner of their organization. Ask for Admin only if you'll manage the repository's settings.
• Before kickoff: the client creates the organization and the repository (GitHub Free allows unlimited collaborators and repositories), and you send your GitHub username. On paid plans, an outside collaborator on a private repository uses one of the client's paid licenses. If the organization requires two-factor authentication, turn it on before accepting.

More in GitHub access for client projects and the GitHub steps.

Commerce

• Ask for: Shopify collaborator access. The client sends the store's permanent myshopify.com address and the 4-digit collaborator request code from Settings > Users > Security. You request access from your Dev Dashboard, and the client clicks Accept request (Shopify). Collaborators don't count toward the store's user limit.
• Not this: the owner's login, or every permission. Shopify advises granting only what the partner needs.
• Before kickoff: you need a Shopify Partner account. Collaborator access expires after 90 days without a login, which matters between project phases.

Exact clicks: Shopify.

Analytics and search

• Ask for: Editor on the Google Analytics property (Admin > Access Management) and Full user in Search Console (Settings > Users and permissions). Both invites need an address with a Google Account (Analytics Help, Search Console Help).
• Not this: Analytics Administrator or Search Console owner, unless you manage their users.
• Before kickoff: with no Analytics property yet, the client creates one under their own Google Account. A Search Console Domain property can only be verified with a DNS record, so plan it with the DNS work.

Email and other services

• Email: a Google Workspace or Microsoft 365 mailbox rarely needs agency access. The risk is DNS, so note the MX records before any change (DNS guide). If the job touches Workspace settings, ask for a role scoped to it (Workspace has prebuilt and custom admin roles), not Super Admin.
• Everything else (forms, maps, transactional email, CRM): the client opens the account with a company email and card, then invites you. If a tool has no second user, follow the password manager steps in Stop asking clients for passwords.

One link per client, with every step checked. Reserve a founding place

How to send the request so clients finish it

A client handed a separate guide for every platform tends to finish the easy ones and stall on the rest, so send one message:

1. Order it by what unblocks the build. Slow setup first, then this week's work, then launch.
2. Give the exact address. One named work email, such as theo@northsidestudio.agency, with a Google Account on it, since Play Console, Analytics and Search Console invites need one. Add your GitHub username. For Shopify, ask for the code and store address.
3. Date each group. "By Friday" gets done. "When you get a chance" doesn't.
4. Warn about expiry. App Store Connect invites expire after 3 days and Stripe's after 10, so ask for them on a day you can accept.

A message from Theo at Northside Studio to Dana at Harbor Fitness might read:

Hi Dana, here's what we need, in the order that keeps the build moving.

Today: please start the Apple Developer enrollment as an organization, beginning with the D-U-N-S lookup, and open a Stripe account in Harbor Fitness's name.

By Friday: invite theo@northsidestudio.agency to WP Engine (Partial, no billing) and WordPress (Administrator), and create a free GitHub organization and an empty repository, then add GitHub user northside-theo to it with Write access.

Once Apple approves: invite the same address to App Store Connect as App Manager.

Before launch: GoDaddy (Domains Only) and Search Console (Full user).

The checklist on one page

Copy this into the kickoff message or your tracker, and drop the areas a project doesn't use.

Sending this to a client? Send one link instead

Doing this for every client?

The areas stay the same from project to project, and only the platforms change. Get Set Keys turns requests like these into one link per client that walks them through each step and checks it is done, with Porter, the AI setup helper, answering their questions on the way. You can reserve a founding place before it launches in November 2026.