If you've hired an agency to build your website or app, they'll need to work inside a few of your accounts: your domain, your website, your app store account, perhaps your payments. Your agency has asked you to invite them, rather than send your password. This page explains why that's the safer choice for you, what they can and can't do once invited, and how to remove them when the work is done. It's written for owners like Dana at Harbor Fitness, whose agency, Northside Studio, is building her new website and app.
If your agency uses Get Set Keys, one link shows you each invite step with their email and the right role already filled in, and checks each step as you finish it.
Send one link insteadAn invite gives them their own key
When you share a password, your agency signs in as you. When you invite them, they sign in as themselves, into your account, with their own password. That one difference gives you four things.
- Your password stays private. You never send it, so there's nothing to change when the project ends.
- Your sign-in codes stay with you. If your account uses two-step verification, signing in on a new device also needs a code. Apple, for example, shows its six-digit code on your trusted devices or sends it to your trusted phone number (Apple). With a shared password, you'd be passing codes to your agency. With an invite, they use their own.
- You can see who did what. Their changes appear under their name, not yours. Stripe, for example, keeps a history of each team member's account activity (Stripe).
- You can take it back in a few clicks. Removing one person doesn't touch your login, or anyone else's.
- Your agency asks for an invite
- You invite their work email from your own account
- They accept with their own login
- They work under their own name
- You remove them when the work is done
Get Set KeysOne link per client
If your agency sent you a setup link, each step already shows their email and the role to choose, so you only follow the clicks in your own account.
Send one link insteadLaunching November 2026
What your agency can and can't do
Every invite comes with a role, which is simply a set of permissions you choose. Your agency should tell you which one they need, and it should be the smallest one that does the job. Here are the roles an agency is likely to ask for on five common accounts.
| Account | Role they'll ask for | What it lets them do | What stays with you |
|---|---|---|---|
| App Store Connect | App Manager | Prepare and submit your app, edit its App Store page and pricing, and run test versions | Your sales, payments and financial reports, signing Apple's agreements, and transferring or removing the app |
| Google Play | Permissions for one app | Only what you tick, such as releasing test versions or managing the store listing | Anything you leave unticked, such as financial data, and your other apps |
| GoDaddy | Domains Only | Your domain's settings, such as where it points and where it forwards to | Your password and Support PIN, your payment methods, and inviting anyone else |
| WordPress | Administrator, or Editor | Administrator: everything on the site, including plugins, themes and users. Editor: pages and posts | With Editor, plugins, themes, settings and users |
| Stripe | Developer | Connecting your site or app to Stripe and creating the keys it uses. It can also see payments and issue refunds | Your bank details and payout schedule, inviting team members, and changing the account owner |
A few things are worth knowing:
- GoDaddy has two kinds of domain access. Management covers everyday settings. Transfer access can move a domain to another account or company, delete it or list it for sale, so leave it off unless your agency is moving the domain for you (GoDaddy).
- WordPress Administrators can add and remove users, so keep your own Administrator account. If your agency only edits content, Editor is enough (WordPress).
- Stripe's Developer role is for the build. Once the work is done, you can change the role or remove it from the same Team tab.
- Ownership doesn't move. An invite is permission to work in your account, not ownership. In Stripe, only the owner can transfer ownership (Stripe), and in App Store Connect, only the Account Holder can transfer an app (Apple).
Get Set KeysOne link per client
On a setup link, the role your agency needs is already filled in on each step, so you never have to guess between options like Admin and App Manager.
Send one link insteadLaunching November 2026
Before you send an invite
- You hired this agency and expected the request
- The email is a named person's work address
- The role is the smallest that does the job
- Ownership, billing and transfers stay with you
- You know how to remove them later
If anything on that list doesn't hold, ask your agency before you send it. A good agency will be glad you asked.
Skip the back and forth. Let one link walk your client through it
How to remove access later
When the project ends, or any time you change your mind, you remove your agency much the way you added them. At the time of writing:
- App Store Connect: In Users and Access, under People, click their name, scroll down, click Delete, then Delete again to confirm. You'll need to be the Account Holder or an Admin, and Apple says it can take up to 10 minutes for access to end completely (Apple).
- Google Play: In Users and permissions, open their user details and select Remove user. When you invite someone, or later from their user details, you can also set an access expiry date, so access ends on its own (Play Console Help).
- GoDaddy: On your Delegate Access page, select Edit next to their name, then Delete (GoDaddy).
- WordPress: In Users, hover over their name and click Delete. Choose Attribute all content to another user, pick your own account, then click Confirm Deletion, so the pages they built stay on your site (WordPress).
- Stripe: On the Team tab in Settings, open the menu in their row to remove them, or click Remove member in their profile. They lose access straight away (Stripe). If they created keys for your website, ask them to help you replace those keys too, which Stripe recommends when someone with access leaves (Stripe).
Get Set KeysOne link per client
When the project ends, your agency can send you a Get Set Keys handover link, which hands the access you gave them back to you.
Send one link insteadLaunching November 2026
What your agency will never ask for
- Your password. Every account on this page has a way to invite a second person. Stripe puts it plainly in its own account checklist: when you give a team member access, don't give them your login credentials.
- A sign-in code from your phone. It's the last line of protection on your account. If anyone asks you to read one out, say no, even if the message seems to come from your agency.
- A bigger role than the job needs. If a role sounds like more than the work, ask what it's for.
Asked for a password or a sign-in code? Say no, and ask for the platform's invite instead. It keeps your password, your codes and your ownership with you, and you can remove the invite whenever you like.
Want to know what a setup link looks like before you open one? Read what to expect from your agency's setup link.
One link per client, with every step checked. Reserve a founding place
Doing this for every client?
This page is written so agencies can send it to their clients. Get Set Keys gives each client one link that walks them through these invites, with your email and the right role already filled in, and checks each step is done. Porter, the setup helper on every link, answers your client's questions straight away and passes anything it can't answer to you. Get Set Keys launches in November 2026, and you can reserve a founding place before launch.