GoDaddy
What GoDaddy Delegate Access cannot do
GoDaddy Delegate Access is the correct way for a client to give your agency access, and it has four permission levels. What it will not let a delegate do is accept an incoming domain transfer, manage payment methods, or view or change account credentials — which is precisely the list of things that tends to block a migration.
Try Delegate Access first
Where this works, it is better than anything we offer: each person gets their own login, their own 2FA and their own audit trail.
- What it is called
- Delegate Access
- Where to find it
- GoDaddy account → Account Settings → Delegate Access → Invite to Access
- Limits
- Delegates can never accept incoming domain transfers, manage payment methods, or view or change credentials. The client has to set it up.
Where that runs out
If you are migrating a domain to a client's account, a delegate cannot accept the transfer — the account owner has to, which means getting them on a call at the right moment. Payment method changes are the same.
What Pair2FA does about it
1. Add the authenticator secret once
Scan the QR code GoDaddy shows during authenticator setup, or paste the Base32 key if it offers one. GoDaddy's documentation describes scanning only, so capture it at setup time.
2. It is encrypted before it is stored
AES-256-GCM at rest. The secret is never shown again unless someone with export permission explicitly asks for it and re-authenticates.
3. Grant only the people who need it
Viewers see the rotating six-digit code and nothing else. Access is per account, so someone working on one client never sees another. Revoking takes one click and is written to the audit log.
GoDaddy team access: common questions
Should the client use Delegate Access?
Yes, always set it up first. It gives your agency its own access under its own login, it is revocable, and it avoids credential sharing entirely. This page is about the specific actions it excludes.
Why can't a delegate accept a domain transfer?
GoDaddy restricts incoming transfer acceptance, payment method management and credential changes to the account owner. These are the high-risk actions, and the restriction is deliberate.
Does this apply to other registrars?
The specific restrictions vary. Namecheap, for example, delegates per domain through Share Access but has no account-level team feature. Check each registrar's own documentation rather than assuming.
What Pair2FA is not. It is not end-to-end encrypted. Secrets are decrypted on our server to generate codes, so a server compromise is part of the threat model. It is built to replace codes forwarded over chat and photographed QR codes, not to replace a hardware security key or a platform's own access controls. Our security page sets out the full threat model.