The best approach for client onboarding with credentials

Client onboarding is a critical moment in any service relationship. It sets the tone for how you'll work together, signals your level of professionalism, and establishes trust. Yet for most agencies, IT providers, and service businesses, the credential exchange that happens during onboarding remains one of the most chaotic and insecure parts of the entire process.

What typically goes wrong during onboarding

Think about the last time you onboarded a new client. Chances are, credentials were involved — and they were probably shared via email, a form, or a messaging app. Here's what that looks like in practice:

• A client emails you their hosting credentials in plain text
• You ask for DNS access and they reply with login details in a chat message
• You send them new credentials for a system you've set up on their behalf via email
• Those messages now live in multiple inboxes, potentially forever

By the end of a typical onboarding, there are credentials scattered across email threads, Slack conversations, and maybe a shared spreadsheet. It's not just a security problem — it's a management problem. Nobody knows exactly where everything is, and the client's sensitive data is spread across systems you don't fully control.

A better onboarding credential workflow

The goal is to make credential exchange secure without making it cumbersome. Clients are already navigating a new relationship, learning your processes, and providing a lot of information. A convoluted security tool adds friction at exactly the wrong moment.

The simplest approach that actually works:

For credentials the client sends to you: Ask clients to use a secure one-time link rather than pasting credentials directly into an email. A tool like PassTransfer lets them create the link themselves — no account required — and share the URL with you. When you open it, the credentials are there once, then gone.

If your client isn't technically confident enough to do this themselves, you can flip the process: set up the secure link on their behalf and ask them to confirm credentials through it, or simply explain that you'll be handling sensitive information this way going forward and walk them through it.

For credentials you send to the client: When you create new accounts or transfer system ownership, use a one-time link to deliver those credentials. The client receives a clean, single link that they open once and save to their password manager.

Document what was shared and when: Keep a record of which credentials were onboarded, via what method, and on what date. This doesn't need to be elaborate — a line in your project management tool is sufficient.

The client experience matters

Clients notice how you handle their sensitive information. Sending credentials via plain email, or receiving them that way, signals that security isn't a priority. By contrast, when you can say "we use secure, one-time links for all credential exchanges during onboarding," it signals professionalism and care.

For agencies and IT providers who want to reinforce this, a branded password sharing experience is particularly effective. Instead of a generic third-party URL, clients see your company's subdomain when they access their credentials. It looks like part of your platform, not a random service you've bolted on.

Building it into your onboarding playbook

The most important step is making secure credential exchange the default, not the exception. Document it in your onboarding checklist:

• All credentials exchanged during onboarding must use secure one-time links
• No credentials to be shared via plain text in email or chat
• All shared credential links to be documented in the project record

When it's a written expectation, your team follows it. When it's just a preference, they default to whatever is fastest.

Client onboarding is your best opportunity to demonstrate that you take security seriously. How you handle credentials in the first few weeks sets the standard for everything that follows. For what comes after onboarding, read how to share passwords securely with clients.