Home / Guides / Client access and permissions checklist for agencies

Client access and permissions checklist for agencies

What an agency should ask a client to grant in their MMP, what to leave switched off, and how the main MMPs name each permission. A kick-off checklist.

Short answer

Ask for the least access that lets you run and report on your own campaigns: campaign read and edit, your own campaigns or networks only, the integrations you manage, and export if you report outside the MMP. Leave billing, user management, app keys, fraud rules and organic data with the client unless the scope says otherwise.

What is a client access checklist?

A client access checklist is the list of MMP permissions an agency asks a client to grant at kick-off, with the reason for each and the ones it deliberately leaves off.

Least privilege: giving each user only the access their job needs. For agencies it is also good sales: a client's security or legal team says yes faster to a short, specific request.

Writing the request down protects both sides. The client knows exactly what the agency can see and change, and the agency has a record if numbers are questioned later. If the client's users are in India, any personal data you can see is data the client must protect under the DPDP Act, which is one more reason to keep access narrow; this note on processors and SDK vendors covers the background.

What to ask the client to grant

Ask for these, and say why:

Campaign read and edit. You need to see and change the campaigns you run. Without edit you are sending change requests by email.
Scope to your own campaigns or networks. Ask to see only campaigns you built, or only the networks you buy. It makes approval easier and keeps other agencies' data out of your view.
Integrations for the networks you buy. If you connect ad accounts, you need that permission; otherwise ask the client to connect them before launch.
Export, if you report outside the MMP. Many agency reports live in a spreadsheet or BI tool. Export is usually a separate permission, so ask for it explicitly.
Cost and revenue, if you are measured on ROAS. If your contract is about return on ad spend, you need to see spend and revenue. If it is about installs or cost per install, you may not.

What to leave switched off

Leave these with the client unless there is a specific reason:

Billing, invoices and plan changes.
Adding or removing the client's own users.
App keys, SDK settings and app deletion.
Fraud rules and postback settings for networks you do not run.
Organic data and other agencies' campaigns.
Raw user-level data, unless the work needs it and the client's privacy team has agreed.

How each MMP names these permissions

The same request maps to different switches in each tool. From each vendor's documentation:

Request	AppsFlyer	Branch	Adjust	Linkrunner
See and edit campaigns	Agency Permissions toggle	Access level per agency	Editor or Custom Editor role	Campaigns read, Campaigns edit
Own campaigns only	Agency traffic via af_prt	Only show agency-tagged data	Link-level access, keyword filter	Only campaigns they built
Certain networks only	Not documented as a scope	Only specific ad networks	Partner-level access	Only certain networks
Cost and revenue	Organic revenue needs permission	Restrict revenue data	View ad spend data toggle	Revenue and spend switch
Export	Raw data export needs permission	Sensitive Data plus Export	Not documented as separate	Export data switch

Elsewhere: Singular lets the advertiser set apps, sources, attribution and link view or edit, and report screens per agency. Kochava offers three profiles (Controlled, Limited, Full). Airbridge sets menu, channel and revenue-event access per agency, marked beta. Tenjin has an Agency user role with channel-scoped export. Each vendor profile lists the details and sources.

Defaults worth knowing

Branch: Only show agency-tagged data is on by default. Agency users cannot, by default, manage the client's team, reset app keys, delete apps or see billing.
AppsFlyer: agencies always see traffic attributed to them, plus default dashboards. Switching permissions off stops new attribution to the agency and makes its historical data non-transparent, so plan the end of an engagement.
Airbridge: without a channel filter, an agency can see other agencies' campaign data. Ask the client to set the filter.
Linkrunner: every agency switch is off by default and only project admins can change them; the agency access documentation lists each one.

The kick-off checklist

Copy this into your onboarding document:

Confirm who owns the MMP account and the billing.
Confirm how the client will invite you (agency account, workspace or user invite) and the email address to use.
List the permissions you need, with one line of reasoning each.
Ask for scopes: your campaigns or your networks only.
Agree whether you see cost and revenue, and why.
Agree whether you need export, and in what format.
Agree how agency campaigns will be tagged so they are credited to you; see the agency attribution guide.
Note what happens to your access and data when the engagement ends.
Run one test campaign and check it appears under your agency before launch.

When the client asks what others grant

Point them to the comparison grid, which shows what each MMP lets a client control, with sources. If you are choosing an MMP together, start with how agencies should choose an MMP.

FAQ

Questions

What access should an agency ask for in an MMP?

Ask for campaign read and edit, a scope limited to your own campaigns or networks, the integrations you manage, and export if you report outside the tool. Ask for cost and revenue only if you are measured on ROAS.

Should an agency have admin access to a client's MMP?

Usually not. Admin access lets you change billing, users and app settings that the agency does not need, and it removes the clear line between your campaigns and everyone else's. A scoped agency role is safer for both sides.

Can a client hide revenue from its agency?

On most MMPs, yes. Adjust has a View ad spend data toggle, Branch a restrict-revenue filter, Airbridge per-event revenue blocking and Linkrunner a Revenue and spend switch; AppsFlyer requires permission for organic revenue.

What happens to agency access when a contract ends?

The client switches the agency off. On AppsFlyer, that also stops new attribution to the agency and makes its historical data non-transparent; on Airbridge it revokes access and expires the agency's API token while the collected data stays.

How does a client invite an agency?

It depends on the MMP. On Branch, the client adds the agency under Account Settings, Agencies, and the agency must accept; on Singular, the advertiser adds it under Settings, Users and Agencies; on AppsFlyer, the agency registers its own account and the client turns on Agency Permissions.

What is an MMP?

A mobile measurement partner (MMP) is the tool an app uses to record which ad, link or campaign led to each install and in-app event. Agencies work inside the client's MMP to build tracking links, read results and prove which campaigns they ran.

More files