Agency operations
Client logins shouldn’t live in a Slack thread
Shared passwords in Slack are keys with no off switch. Access is part of the social job.
On this page
TL;DR
Slack is great at “Here’s the login.” It’s terrible at “Give it back.”
Haba Social’s Vault comes with every paid plan and keeps client logins in one place, not in chat.
Before you share a login, ask yourself: “If they left today, could I take this back in one click?”
Nobody would paste the company's bank PIN into a group chat. Plenty of agencies do the equivalent with a client's Instagram.
Agencies rarely lose an account over a bad caption. They lose it because the password has been sitting in a Slack thread since 2023, and the freelancer who left in March still has it. That is not a content problem. It is an access problem dressed as one.
Everyone has a copy
Follow a single client login through a busy agency and it turns up everywhere: in a Notion doc titled "Socials: DO NOT SHARE", in a Slack DM, in somebody's personal password manager, in an email sent "just this once". Nobody owns the list and everyone has a copy, so when someone leaves on a Friday, nobody checks the doors.
The trouble is that passwords get treated as information ("here's the login") when they are really keys. Information wants to be shared; keys need to be taken back. Slack is very good at spreading information and very bad at taking anything back.
Access is part of the job
Social work used to be described in three verbs: plan, publish, measure. Agencies now have a fourth, which is managing access. Who can see a login? Who can publish? Who loses access on the day the contract ends? If the honest answer is "whoever was in that channel", the agency does not have a system. It has a group chat with root privileges.
Secrets versus roles
The fix is less a new tool than a change of category. The shared secret is one password, many people and an unknown number of copies. The revocable role is a named person with a named permission and a single switch to turn it off.
In practice that means knowing every client account and every place its login currently lives, then gathering them into one vault (or a proper password manager with team roles) rather than another spreadsheet nobody opens. It means separating viewing from publishing, because the strategist rarely needs the same key as the community manager. And it means removing access on the day someone leaves, not "next quarter".
This is the gap Haba Social's Vault is built to close. It comes with every paid plan, holding 10 logins on Starter, 50 on Creator and an unlimited number on Agency, so access sits next to the rest of the work rather than in a separate drawer: plan, publish, measure, manage access. For agencies the promise is to run every client's social operation from one place, without passwords in chat. The payoff is time saved and fewer locked-out mornings, not cleverer posts.
One click, or not
Pick any account on the roster and imagine the person with access walked out today. Could they be removed in one click? If the answer is no for most clients, the agency does not have a password problem. It has a liability with a client's name on it.
The brand's Instagram is not a group-chat PIN. It is a key, and the only keys worth handing out are the ones you can take back.
