Client Access in a Social Media Scheduler: What to Check
Every scheduler comparison answers one question with a yes. Can my client see the work before it goes live? That yes covers three different products: a paid seat, a separate workspace for the client, or a link anyone can open. Which one a vendor built decides how much evidence you hold when a post goes out wrong, and what offboarding costs a year later.
I build PostSider and sell it, so the bias is up front: it supports two of the three models below, and I will say which.
Buyer guide: three access models, one approval state, no shared passwords.
In short
- A client needs to see the post as it will render, say yes or no to that item, and know what published. A login is one way to deliver that. It is not what access means.
- Per-seat pricing makes an occasional reviewer look expensive, so agencies ration access and approve over email. That is the failure the scheduler was meant to remove.
- Ask in a demo whether approval locks the version that publishes, and whether you can prove later who approved it.
Client access is an access model, not a share link
A client does not want a login. They want to see next week’s posts in the shape they will appear, object to one, and trust that the approved version is what publishes. Those are capabilities, and a session on your workspace is only one route to them. That session also brings visibility rules you maintain, a password reset before a launch, and an access review whenever someone on their side changes job.
Attribution is the distinction that matters. A surface that shows a post is not one that records a decision against a named person. When a client approves by email, the scheduler cannot act on it, so someone re-types the approval into the queue and the record lives in a mailbox nobody exports. A public link carries the same weakness unless it captures a name and a time.
Access is only as useful as the decision it leaves behind.
Three models, three failure modes
Every scheduler with client review picks one of three models, sometimes two. Each moves cost and risk somewhere different, and each fails predictably.
| Model | What the client gets | What it costs you | Where it breaks |
|---|---|---|---|
| Paid seat | A user account inside your workspace | A recurring fee per reviewer, plus onboarding and password support | Seat sprawl, permission bleed between brands, a bill for idle reviewers |
| Per-client workspace | Their own space with roles scoped to it | Setup time per client, channel capacity, duplicated templates | Workspace sprawl, reporting assembled by hand, offboarding discipline |
| Approval link | A URL, no account | Almost nothing to set up | Anyone with the link can approve, no identity on the decision, links expire mid-review |
The models are not equally good at proving what happened. A seat records a named person, a workspace records a boundary, and a link records only that somebody opened a URL. When a client disputes a post, or a regulator asks who signed off on a claim, that difference is the whole answer.
A hybrid works if the split is deliberate: an account for whoever carries sign-off authority, a workspace per client, and a link for a stakeholder who wants a glance. The failure is a link for the approver and a seat for someone who never logs in.
PostSider covers the first two: a workspace per client, unlimited team members from Team, approval requests in a queue. There is no public approval link and no client portal, so if a link with no account is a hard requirement, look elsewhere. I would rather you hear that now.
Seats are the wrong unit for clients
A seat is priced for someone who uses the tool all week. An operator schedules, edits and fixes failures daily. A client approver opens the queue on Tuesday, reads four posts, and disappears until the next batch. Charging the same unit for both makes the client look expensive, so agencies ration access: one shared login, approvals pasted into email, screenshots in Slack.
Take a $20 seat as an illustration: ten client reviewers is $2,400 a year for people who log in twice a week, before the password resets.
A seat is still right in specific cases: the client’s team operates the channel and connects its own accounts, procurement requires a named account for everyone who touches the work, or the client reviews daily and a shared queue would slow them down. A seat also gives you a per-person audit trail without extra machinery.
Look instead for a plan where reviewers are included rather than metered. PostSider puts unlimited team members on Team and above and one seat on Standard, so the marginal reviewer does not change the monthly bill. Channels decide the tier: 5, 10, 30 or 100, which is why the pricing page is where a roster gets modeled. The trade-off is account hygiene. Every reviewer is a real account, so disabling it when the person leaves the client is your job.
Approval needs a state, not a screenshot
An approval is a fact about a version of a post at a moment in time. Store it as a checkbox and three questions become unanswerable: which caption was approved, who approved it, and whether anyone edited the post between approval and publish.
Four states have to be separate in the data model, and a vendor should name all four. Queued means planned with no time committed. Approved means this version is signed off. Scheduled means a time is locked and a worker will attempt it. Published means the platform returned an identifier. A fifth matters too: failed, which means the platform refused and a human has to look.
The audit record needs the actor and the account, the timestamp with timezone, the caption and media version that was on screen, the target channel, the schedule time the decision produced, and any edit made afterward.
That last item is the hole in most approval workflows. A post is approved Monday, someone fixes a price Wednesday, and what publishes Thursday is not what the client saw. The scheduler should either lock the approved version or invalidate approval when the caption or media changes. Ask which one it does, because plenty of tools do neither and call the checkbox a workflow.
PostSider exposes approval requests and approval status as objects the API can read, so a status board shows pending client decisions without a client login. Approval workflows start on Team and the audit log on Pro, so a solo operator on Standard reviews by hand. The mechanics are in the client approval workflow.
Separation protects you at offboarding
The access model gets tested the day the client leaves. Three things decide whether that is an hour of admin or a month of migration: who owns the channel connection, what the client can export, and whether their history is tangled with another client’s.
For Meta, LinkedIn and Pinterest, the durable arrangement is the client’s own business account adding your agency as a partner. Removing the partner ends access in one action. Where a platform has no partner model, the connection should still sit under the client’s own login. A connection under an agency-owned profile dies with that person’s employment, and the channel then needs an authorization only the client can grant. Check that before the first post.
API credentials deserve the same scrutiny. A key that can touch one workspace is a contained risk. A key that can touch every client you manage is a liability carried for convenience, and the first thing an auditor asks about. PostSider separates clients into workspaces, groups them for an agency overview, and its public API runs at 60 requests per minute, so a runaway script hits a limit rather than a client’s calendar.
Then there is what leaves with them. Captions, media, performance history and the record of who approved what should export without a support ticket. If someone has to pull it together, you have a favor rather than an export. Ask during the trial and time it.
The structural argument is in one workspace per client: a boundary from day one takes minutes to close, and one you reconstruct at exit takes weeks.
A five-question vendor checklist
Five questions separate a real access model from a demo. The answer that should worry you is usually the one that sounds helpful.
- Can a client review and approve without holding an account? If no, because every reviewer needs a paid seat, price the whole client roster before you sign. If yes, because anyone with the link can approve, ask what the link records. Without a name and a timestamp you cannot prove who signed off.
- Is access scoped to one client’s channels, queue and history? A shared workspace with folders is the answer to worry about. Folders organize content and do not stop a person from posting to the wrong channel.
- Does approval lock the version that publishes? Worry when the checkbox stays set while the caption changes underneath it, and nobody notices until the client does.
- Can you read approval state and publishing state separately, outside the UI? Worry when the only status is scheduled. A row marked scheduled means your worker will try. It does not mean the platform accepted anything.
- Who owns the channel connection, and what can the client export when they leave? Worry when the connection sits under an individual’s login, or when export depends on someone still having access.
Score the vendor against your most demanding client. A legal reviewer or a two-person approval chain will find every gap within a month, and closing it later costs more than checking now.
To see how the first two models look in a product, the agency scheduling setup covers workspaces, approvals and channel capacity. Start with the roster math on pricing, then test one client before moving the rest.
Frequently asked questions
Does a client need a paid seat to review posts?
It depends on the access model, not on the size of the client. Some schedulers include reviewers at no extra cost on a team tier, others charge for every account, and approval links need no account at all. PostSider includes unlimited team members from the Team plan, so adding a client reviewer does not change the monthly price.
How do I stop one client from seeing another client's posts?
Use a separate workspace or organization per client, with roles scoped to that workspace. Folders inside one shared workspace organize content but do not restrict permissions, so anyone with access can still select the wrong channel. In PostSider each workspace carries its own channels, queue, history and credentials.
Can a client approve a post without creating an account?
Only if the vendor supports an approval link or a guest reviewer role. A link is cheap to send, but the decision usually has no named identity behind it, so it proves that someone with the URL clicked approve. If the client carries real sign-off authority, a named account leaves the stronger record.
What should happen to client access when a contract ends?
Revoke the accounts, export the client's captions, media and performance history, disconnect their channels or hand the connection to them, and archive the workspace instead of deleting it. Confirm in writing which side keeps the platform connection, because an OAuth token tied to an individual's login often dies with that person's access.
