TikTok
When a client has not set up TikTok Business Center
TikTok Business Center handles this properly: add your agency as a Partner, assign ad account roles of Admin, Operator or Analyst, and nobody shares a credential. The gap is the client who has never set Business Center up and simply sends you a login.
Try Business Center — Members and Partners first
Where this works, it is better than anything we offer: each person gets their own login, their own 2FA and their own audit trail.
- What it is called
- Business Center — Members and Partners, with ad account roles
- Where to find it
- TikTok Business Center → Members, or Partners → Add partner
- Limits
- The client has to configure Business Center and invite you. Admins can enforce 2-step verification for all members.
Where that runs out
A client who has not configured Business Center, or an organic TikTok account without the account-sharing permission enabled. Creative deadlines do not wait for a client to read documentation.
What Pair2FA does about it
1. Add the authenticator secret once
Scan the QR code TikTok shows during authenticator setup, or paste the Base32 key if it offers one. TikTok's documentation describes scanning only, so capture it at setup time.
2. It is encrypted before it is stored
AES-256-GCM at rest. The secret is never shown again unless someone with export permission explicitly asks for it and re-authenticates.
3. Grant only the people who need it
Viewers see the rotating six-digit code and nothing else. Access is per account, so someone working on one client never sees another. Revoking takes one click and is written to the audit log.
TikTok Ads Manager team access: common questions
Should the client use Business Center?
Yes. Partner access through Business Center is the right model and should be your default ask. It takes the client about ten minutes.
What about organic TikTok accounts?
Business Center covers ad accounts well. Organic account access depends on the TikTok account sharing permission being enabled, which is a separate setting and not always available.
Can 2FA be enforced across the team?
Yes — Business Center admins can require 2-step verification for all members, which is worth turning on once you are set up properly.
What Pair2FA is not. It is not end-to-end encrypted. Secrets are decrypted on our server to generate codes, so a server compromise is part of the threat model. It is built to replace codes forwarded over chat and photographed QR codes, not to replace a hardware security key or a platform's own access controls. Our security page sets out the full threat model.