Partnership ads let a brand run a creator's post without the password

Instagram partnership ads access is a permission, not a login. The creator grants it from their own professional account, either for one post or for their account as a whole, and the brand then runs a paid ad with the creator's handle and post from the brand's own ad account. The creator does not send a password, the brand never signs in as the creator, and the creator can take the permission back without changing anything else.

That replaces an old agency habit: asking a creator for their Instagram password so somebody could boost a post. The habit outlived its reason, and it does real damage to the creator's account.

What Instagram partnership ads access gives a brand

A partnership ad shows two names at the top: the creator's and the brand's. The post can be one the creator already published, or content the brand supplies to run under both handles. The money comes from the brand's ad account, and the audience, budget and schedule are set in the brand's Ads Manager, like any other ad.

What the brand gets is the right to use the creator's handle and content in ads. It does not get the account. The creator's messages, settings, other posts and followers stay where they were, and the brand's people never see a sign-in screen for the creator's account.

How it works: Logins and 2FA codes

Two ways to grant it

The first is per post. The creator opens the post's partnership settings, turns on a partnership ad code, and sends the code to the brand. The brand pastes the code into its ad in Ads Manager. One code is one post, so a creator who has agreed to one ad has given access to one post and nothing more.

The second is account-level. The brand sends the creator a permission request, the creator accepts it in the Instagram app, and the brand can then run ads with the creator's posts that feature the brand without asking for a code each time. That suits a long relationship and is wider, so it is worth agreeing in writing which posts it covers.

Meta moves and renames these settings, so look for the partnership label and ads options on a post rather than an exact menu path, and read the help page on the day you set it up.

Why the password habit hurts the creator

Before this permission existed, the shortcut was to sign in as the creator. Somebody at the agency typed the creator's password into a browser on an agency laptop, boosted the post, and moved on. Every part of that is worse than it looks.

The sign-in looks like a takeover. An account that always signs in from the creator's phone suddenly appears on a laptop in another city. Instagram's security checks are built to notice that, and the common answer is a challenge sent to the creator's phone at the moment the campaign is meant to start. If somebody turned two-factor off to make sharing easier, the account is now weaker for everybody.

The laptop ties accounts together. A browser that signs in to one creator's account keeps cookies, a fingerprint and an IP address the platform has now seen beside that account. Sign in to five creators from the same browser and the platform has seen one device across five accounts that have nothing else in common. Meta already joins accounts a person links on purpose, through Accounts Center (what Accounts Center joins lists what), and a shared device is a join nobody chose.

And the access never ends. A password does not expire when the campaign does. Everybody who saw it keeps it until the creator changes it, and a creator rarely knows who saw it. A spreadsheet of client passwords has the same fault in bulk (the shared password spreadsheet covers what replaces it).

What the brand's side should look like

The brand, or the agency working for it, needs its own house in order before it asks for any creator's permission. The ad account sits in the brand's business portfolio, and an agency reaches it as a partner rather than through somebody's login, the same model sharing a pixel with an agency describes for datasets.

Where Mosaic fits is on that side, and only there. Each person at the agency signs in to Meta with their own account in a profile of their own, with its own cookies and its two-factor setup key in that profile's vault. A creator's account does not belong in any of them, and partnership ads access is the reason it never has to. Mosaic keeps accounts you are entitled to run apart; it does not change what a platform allows.

Once a quarter, the brand's people and partners list should match the agency's own records, and a creator's login turning up anywhere on the agency's side is the first thing to remove. A quarterly access audit sets out that two-list check.