Access for freelancers and clients

Result

You have an access register with one user's full life, from onboarding to offboarding, and you know which keys you never lend a freelancer.

Estimated time

35 minutes

Cost

US$ 0. Creating and deleting users uses no wallet balance.

Analogy

Step-by-step guide

Menu paths are shown as they appear in the English interface, with the Spanish name in parentheses for teams that work in Spanish. Meta and Google labels are shown as they appear on their English pages.

1. 01

   One person, one key: never lend yours

   Before you give anyone access, set the rule: each person signs in with their own user and their own email. That goes for your freelancer, your virtual assistant and your client.

   You never lend your HighLevel user, the business's Facebook password or a Google account. Not an API key or a token either.

   HighLevel's Terms make you responsible for every use of your account and your credentials, whether or not you authorized it.

   To HighLevel, your credentials include your API keys and access to your integrations. A lent token is a lent password.

   Under those Terms, you also answer for what your employees, contractors and clients do on the platform.

   Users are unlimited on every plan. One more user costs nothing, so lending yours saves you nothing.

   Key points

   • What HighLevel requires: you answer for every use of your access, and two-factor authentication goes on your account and on every user under it.
   • What AXIS recommends: one person, one user, always. The Terms have no sentence that says «don't share your password», but the rule follows from the above.
   • Two-factor authentication belongs to one person: only the signed-in user can link their code app to their user. Ask each person to turn it on their first day.
   • With a lent user, everything is logged under your name. If something goes wrong, there's no way to know who did it.
   • HighLevel lists a password change and a virtual assistant logging in from another country without a VPN among the reasons the Facebook connection breaks.

   Source: F1, F2, F3, F4

2. 02

   The freelancer's key: only their floor and their doors

   Agency View → Settings → Users → Edit user → Roles & permissionsCopy path

   In a Spanish-language account: Vista de agencia → Configuración → Usuarios → Edit user → Roles & permissions

   In Agency View, open Settings → Users. Use + Add user for someone new, or the pencil on their row (Edit user) to review someone who already has access.

   In Roles & permissions, a freelancer or virtual assistant gets User type Account and User role User. It's the key you cut in lesson I.2.2.

   In Add sub-accounts, leave only the sub-accounts they work in. If they work for two of your clients, both go in; if for one, only that one.

   On the module cards, switch on only what their task needs. Someone building workflows needs Automation; someone answering messages, Conversations and Contacts.

   Keep the safe locked: Account Billing, the sub-account's Billing with its cards. Also the permission to create, edit and delete users (User Management; «View & Manage Users» in the help).

   If they work in sales, switch on Restrict data visibility to only assigned data. That way they see only the contacts and opportunities you assign them.

   Save. HighLevel emails them the invitation. For the next person with the same job, use Copy Permissions and check every card before you save.

   Key points

   • Never give a freelancer an Agency user: it opens every sub-account in your agency. HighLevel says to avoid agency access unless it's needed.
   • Even less Agency with the Admin role. Agency admins get Login As by default, to enter a sub-account as one of its users without their password, and they can create tokens.
   • An Account user never reaches what lives only at the agency: its billing, your company profile, creating sub-accounts, snapshots and SaaS mode.
   • The rule is called least privilege: everyone gets the minimum their work requires. HighLevel recommends it, and it's the standard of NIST, the US standards institute.
   • No HighLevel article says which modules come switched on for a new user. Check every card before you save instead of trusting the defaults.
   • If their email already belongs to a user in your agency, HighLevel won't create another and shows you what to do. Usually, you add the sub-account to the existing user.
   • Switching a module off doesn't stop the workflows already running in it. If the freelancer built workflows, they keep running after you remove access.

   Source: F5, F6, F7, F8, F9, F10, F11, F12, F29

3. 03

   The client only enters their own unit

   (client's sub-account) → Settings → Users → + Add userCopy path

   In a Spanish-language account: (sub-cuenta del cliente) → Configuración → Usuarios → + Add user

   Add your client inside their own sub-account, as an Account-type user. That way they never see your agency or your other clients.

   Pick User if they'll only look or serve customers: see their contacts, answer messages, check their calendar. Switch on only those modules.

   Pick Admin only if they'll manage their own team. A sub-account admin can add and edit users at their level.

   Even as an admin, your client can't reach what lives only at the agency: your billing, your snapshots, SaaS mode or your company profile.

   Check the cards as you did for the freelancer, and leave on only what the client will use.

   Add them to your access register, like anyone else.

   Key points

   • If your client runs their own team, hand them this same checklist: each person, their own user.
   • A sub-account admin can also delete users from their list. In a 2023 report, a client deleted their agency's assistant this way and removed her from every sub-account.
   • If your client ever moves their sub-account to another agency, only the Account users assigned to that sub-account alone go with it.
   • That move deletes every connection the sub-account has, like Google or Facebook. Its API keys, though, stay the same: change or delete them first.

   Source: F6, F7, F8, F9, F18, F28

4. 04

   Facebook and Google access goes by invitation, not by password

   (sub-account) → Settings → IntegrationsCopy path

   In a Spanish-language account: (sub-cuenta) → Configuración → Integraciones

   The freelancer who connects Facebook or Google doesn't need your client's password. They need an invitation to their own account.

   Meta: your client adds them to their business portfolio, as a person or, if they're an agency, as a partner. Then the client assigns the Page and the ad account.

   HighLevel requires whoever connects Facebook to be an Admin of the Page and of the portfolio it lives in. Its help doesn't say whether partner access is enough.

   Under the sub-account's Settings → Integrations, Facebook and Instagram are separate cards, each with its own Connect button.

   Google Business Profile: the profile's owner invites them by email as Manager. An Owner can remove people, so keep that for the owner. Each person signs in with their own Google account.

   To connect that profile to HighLevel, a Google account with Owner or Manager access is enough.

   Google Ads: your client invites their email and picks the level. Standard edits campaigns, but also billing information. If they only need to see results, Read-only is enough.

   Log every invitation in your register: who, which system, what level and since when.

   Key points

   • In Meta's help center, the partner guide is «Give a Partner Access to Business Assets in Your Business Portfolio». The people guide is «Add People to a Business Portfolio and Assign a Business Asset». Follow their steps there.
   • Admin of the portfolio is a big key in Meta. If you can, have your client connect with their own profile. If the freelancer connects, keep it to the task and log it.
   • Lending the Facebook password breaks things: a password change or a login from another country can knock out the HighLevel connection.
   • In Google Business Profile, only owners remove people. The primary owner can't leave without first passing that ownership to someone else.
   • Someone new to a Google Business Profile waits 7 days to delete it, remove others or transfer primary ownership. None of that is your freelancer's job.
   • On the last day, remove these accesses where they were given. In Google Ads: Admin → Access and security → Remove access.

   Source: F19, F20, F21, F22, F23, F24, F25, F26, F4

5. 05

   Guard API keys and tokens like passwords

   (sub-account) → Settings → Private IntegrationsCopy path

   In a Spanish-language account: (sub-cuenta) → Configuración → Integraciones Privado

   An API key or a token is a key for apps: it lets another tool read or change data in your account.

   Today they're called Private Integrations and they live in each sub-account's Settings. The old agency keys are still under Settings → API Keys in Agency View.

   If a tool needs a token, create it yourself: one per tool, with only the permissions that tool uses.

   HighLevel shows the token only once. Copy it straight into a password manager and paste it into the tool.

   Never send it by chat or email. If the freelancer is setting up the tool, paste the token in yourself.

   Rotate it every 90 days, as HighLevel recommends. When you rotate, the old and new tokens both work for 7 days.

   If a token leaked, use Rotate and expire this token now: the old one stops working right away.

   When the tool is no longer in use, delete its integration.

   Key points

   • HighLevel's Terms count API keys and integration access as credentials. You answer for them just like your password.
   • By default, every agency admin can create and manage tokens. One more reason a freelancer should never be an agency admin.
   • API v1 keys lost support on 31 December 2025, and new ones can't be created. HighLevel deletes keys that go 90 days unused on its own.
   • Each agency and each sub-account can hold up to 20 tokens. Delete the ones you no longer use.
   • Leave Enhanced Account Security on Enabled, under Settings → Company → Advanced Settings. That way a new sub-account doesn't generate API keys on its own.

   Source: F12, F13, F14, F15, F1, F32

   Freelancer or virtual assistant

   Account · UserSub-accounts: only where they work

   Modules: their task’s

   Facebook and Google: invitation to their own account

   Tokens: none; the owner creates them

   Client

   Account · User, or Admin if they manage their teamSub-accounts: only their own

   Modules: the ones they will use

   Facebook and Google: owner of their accounts

   Tokens: none

   You, the agency owner

   Agency OwnerSub-accounts: all

   Modules: all

   Facebook and Google: invitation, if you connect

   Tokens: you create them, one per tool

   The safe: Account Billing · User Management · API keys and tokens · agency billingFreelancer: no

6. 06

   Run the checklist: from onboarding to offboarding your test user

   (your sub-account) → Settings → UsersCopy path

   In a Spanish-language account: (tu sub-cuenta) → Configuración → Usuarios

   Download this lesson's template. Fill in the row for your test user «Front Desk» from lesson I.2.2: role, sub-account, modules, start date and who approved it.

   Check the four onboarding items against it. Items 2 and 3 are fixed in Edit user. Only the person can turn on item 1's two-factor: for your test, write «N/A». Log item 4 today.

   Offboarding, item 5: open Settings → Audit Logs in your sub-account and filter by that user. Review what they did; to keep a copy, export to CSV. If they only looked around, the list may be empty: Audit Logs records changes, and its help doesn't mention logins.

   Item 6: reassign their contacts, opportunities and appointments to someone else. Your test user has none, but with a real freelancer you never skip this item.

   Item 7, first: end their sessions. From the profile icon at the top right, enter as them with Login As, which only agency admins have. Open Settings → My Profile → Security and use Sign Out Everywhere. That session ends too: sign back in as yourself.

   Then, in your sub-account's Settings → Users, find «Front Desk» with your code and delete it with the trash icon on its row. Read the warning before you confirm.

   Item 8: your test user had no Meta or Google access and saw no tokens. Note that in the register.

   Close the row with the end date and how it was done, for example «deleted in Settings → Users». That row goes in your evidence.

   Take your screenshot: your sub-account's Settings → Users without «Front Desk», with the sub-account name in the switcher.

   Key points

   • HighLevel documents no way to deactivate a user: you can only delete one. Its users ask for it on its ideas board, with no reply from HighLevel.
   • On that board, one user reports that deleting someone leaves their contacts without an owner. That's why you reassign first.
   • When you added it, HighLevel may have created a personal calendar, «Front Desk AX-7K2Q's Personal Calendar». After deleting the user, check Settings → Calendars to see if it's still there. With a real freelancer, check first whether their calendar has appointments.
   • If the person still works with another of your clients, don't delete them. In Agency View, open their Edit user and remove only that sub-account from Add sub-accounts.
   • There are reports that deleting someone from one sub-account's list deleted them from all of them. To remove a single client, always use Add sub-accounts.
   • Audit Logs keeps 60 days. Per HighLevel's December 2025 help, what an admin does through Login As shows under the user's name.
   • If you ever lent your password, change it in My Profile → Security and use Sign Out Everywhere on your own user, as in lesson I.2.1.
   • Review the register every quarter: do they still work with you, and do they need the same access? HighLevel says to review permissions periodically; the quarterly rhythm is AXIS's recommendation.
   • In that review, check Support Access too: it should be off unless you have an open case with HighLevel support.
   • The US cybersecurity agency (CISA) documented an attack that got in through a former employee's account nobody disabled. Offboarding is security too.

   Source: F17, F11, F33, F27, F28, F5, F30, F31, F16

   1 · Onboarding

   Their own user, with their email and their 2FA

   Account · User, only in their sub-accounts

   Only their task’s modules; no Account Billing or User Management

   Logged in the register, with who approved it

   2 · Quarterly review

   Still working with you?

   Still needs the same access?

   Support Access off

   3 · Offboarding

   Audit Logs before 60 days

   Reassign contacts, opportunities and appointments

   End sessions and delete, or remove only that sub-account

   Meta, Google, tokens and end date

   Access registerRuns along the whole line: who, what it opens, since when, who authorized it and when it closed

   (your sub-account) → Settings → Users

Interactive

Onboarding and offboarding one access

This interactive is used inside your AXIS account.

If it breaks

The mistakes that repeat most, and the way out.