Governance
How to stop sharing a YouTube password with an editor or agency
Replacing a shared password with named roles closes the exposure without breaking a collaborator's access.
Is this your situation?
You have been sharing a YouTube password with an editor or agency and want to close that exposure. You need a way to give the same access through named roles instead of a shared credential.
Where teams go wrong
- Removing the password but not the sessions You change the password but roles granted through channel permissions still have access.Why it happens: Channel permissions let people be granted access without needing access to the Google Account.Already happened: Review who still holds access using the audit guide.
- Assuming any role can manage others You assume every collaborator can see who has access.Why it happens: Only managers and the owner can view names and emails of people that have access to a channel.
- Skipping the Brand Account step You try adding roles before switching the Brand Account to permissions.Why it happens: A Brand Account owner must switch to channel permissions to add or remove access to a YouTube channel.
What good practice looks like
| Practice | What it looks like | Why it matters |
|---|---|---|
| Shared password | One login used by owner and collaborator alike | Migrating to channel permissions helps prevent security risks such as password sharing. |
| Named role access | Each person invited by email under a role | Channel permissions let people be granted access without needing access to the Google Account. |
| Removing access | Access removed for one person only | Granting channel permissions is safer than sharing a password or sign in details. |
| No Brand Account | Channel not connected to a Brand Account | If a channel is not connected to a Brand Account, you can change managers but not owners. |
How YouTube handles this
- Channel permissions allow you to give other users access to your channel via specific roles.
- A Brand Account owner must switch to channel permissions to add or remove access to a channel.
- Only managers and the owner can view names and emails of people that have access to a channel.
- Once a channel permissions invite is sent, it expires after 30 days.
- Granting channel permissions to someone is safer than sharing a password or other sensitive sign in details.
Before you start
- Confirm the channel uses a Brand Account A Brand Account owner must switch to channel permissions to add or remove access.Verify: Check Settings for the account type in use.
- Identify who holds the password List everyone who signs in with the shared login.Verify: List every collaborator who signs in with the shared credential.
- Decide the role for each collaborator Channel permissions let you give other users access to your channel via specific roles.Verify: Match each collaborator to the role they need.
- Prepare to send invites from Settings On desktop, granting access requires signing in to YouTube Studio, clicking Settings, Permissions, then INVITE.Verify: Check that Permissions shows an INVITE option.
Which scenario is yours?
- Is the channel already on a Brand Account? A Brand Account owner must switch to channel permissions to add or remove access to a YouTube channel.
- Is the collaborator an agency needing broader access? Channel permissions allow you to give other users access to your channel via specific roles.
- Has the channel not yet migrated to channel permissions? A Brand Account owner must first migrate to channel permissions before granting channel access using permissions.
- Does an existing collaborator's role need to change? On desktop, a user goes to Settings, clicks Permissions, finds the person, clicks the down arrow under Role, then selects a new role or clicks Remove access.
- Is the password still known to someone who no longer works with you? Granting channel permissions is safer than sharing a password or other sensitive sign in details.
Keeping this working over time
- Review who holds access on a regular schedule rather than relying on memory of who received the password.
- Audit current access through the access audit process before removing any shared credential.
- Know your Brand Account's ownership details, since this is the channel owner's responsibility.
- If you can't find your name in the Brand Account permissions list, you must be added as an owner by another channel owner.
If control is already lost — What to Do if Your YouTube Channel Was Stolen
Keeping track of who has access
Replacing a shared password with named roles is what managing access across people is meant to make clear. Delvia gives a single view of who holds which role on a channel. That view makes it possible to notice a shared credential still in use before it turns into an exposure. Managing access this way keeps ownership visible as collaborators change and roles shift over time.
Was this helpful?