---
title: "One-Time Credential Sharing for Client Onboarding"
url: https://uselinkpilot.com/blog/one-time-credential-sharing-for-client-onboarding
description: "For agencies and MSPs: send the first login as a one-time link, share confidential onboarding instructions the same way, and record the handoff."
lang: en
---

Security (https://uselinkpilot.com/blog/category/security)

# One-time credential sharing for client onboarding

For agencies and MSPs: send the first login as a one-time link, share confidential onboarding instructions the same way, and record the handoff.

LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 26, 2026 · About LinkPilot (https://uselinkpilot.com/about)

Every new client starts the same way: someone on your side creates their account, and someone has to tell them the password. For an agency, a managed service provider or a SaaS team with a hands-on onboarding process, that moment repeats dozens of times a year, and the welcome email with the credentials in it is one of the most reliable leaks in the business.

One-time credential sharing for client onboarding replaces that email with a link that is destroyed the first time it is opened. The routine below takes a minute per client, works for the first login and for confidential onboarding instructions alike, and leaves a record you can point to later.

## What the welcome email should and should not carry

Onboarding mixes two kinds of information. Sort them before you write anything.

| Goes in the normal email | Goes in a one-time link | | --- | --- | | Welcome note, kickoff schedule, who to contact | Initial password or access code | | Public help articles and the login URL | API keys, webhook secrets, integration tokens | | What the client will receive and when | Internal procedures, admin URLs, anything you would not want forwarded | | Their username (on its own) | Any passphrase or recovery code |

The rule of thumb: if a forwarded copy of the email would let someone act as the client, that line belongs in the link.

## The routine, step by step

1. **Create the client's account** with its own login and the role it needs. If your platform supports it, make the first password temporary so the client must change it on first sign-in.
2. **Verify the contact.** Use the name and address from the signed agreement or the kickoff call. If credentials were requested from a new address, confirm by phone with the person you already know.
3. **Create the one-time link (https://uselinkpilot.com/glossary#one-time-link).** Paste the password into the secret link tool (https://uselinkpilot.com/tools/free-secret-link-generator) and nothing else. The text is encrypted in your browser before it is stored, the stored copy is destroyed on first open, and the link expires at the time you set if nobody opens it.
4. **Set the expiry to the real window.** One hour if you are on a call with them, 24 hours if they will pick it up later. Set the view limit to one.
5. **Add a passphrase on a Pro account** for admin-level access, and send it by text message or read it out on the call.
6. **Send the link in the welcome email** with the username, the login URL and one line saying the link opens once and expires at a stated time. The email now contains nothing an attacker can use.
7. **Confirm access, not the value.** Ask the client to sign in and change the password. If the link reports it was opened before they got to it, reset the credential and send a fresh link.
8. **Record the handoff**: client, account, who received it, when, and when the temporary password was replaced. Never the password.

One MSP pattern we see often: the temporary admin password goes out as a burn-after-read (https://uselinkpilot.com/glossary#burn-after-read) link with a one-hour expiry and a passphrase sent by SMS, and the audit timeline on the Pro plan later shows the exact minute the client opened it. That timeline is the evidence when a client asks who had access and when.

## How to share confidential onboarding instructions with a one-time link

Credentials are the obvious case, but onboarding also includes material that is not a password and still should not be forwarded: the admin console URL and its initial access code, the steps to connect their payment provider with a live key, a runbook for the integration you are building for them, or a client-specific procedure with internal details in it.

Share confidential onboarding instructions with a one-time link in the same way, with three adjustments:

- **Write the instructions in the order the client will do them**, naming the official portal or application at each step, so they do not need to ask follow-up questions in email that quote the content back.
- **Keep the permanent parts out.** A link that burns on first open is wrong for a reference the client will return to. Put the durable guide in your client portal or help centre, and use the one-time link only for the confidential part: the code, the key, the internal URL.
- **Attach a file when the content is a document.** From a signed-in LinkPilot account you can attach up to three files of 9 MB each, encrypted in your browser before upload and deleted after one download. A PDF of the client-specific setup steps fits easily.

Tell the client in the kickoff call who will send the link and roughly when, so an unfamiliar link from your domain does not look like phishing (https://uselinkpilot.com/glossary#phishing), and so they do not open it on a shared machine before they are ready.

## Scaling it across clients

An agency with many clients needs the routine to survive handoffs between account managers.

- **One account per client, one credential per person.** Shared "agency@" logins cannot be audited or removed cleanly. LinkPilot's Agency plans give each client an isolated workspace with its own members and domain, so access is per client by design.
- **Set the expiry by default**, not by judgement. Most teams settle on 24 hours for onboarding links and one hour for live calls.
- **Keep the record in the CRM**, not in the email thread: date, recipient, which credential, when it was replaced.
- **Rotate on contact change.** When the client's main contact leaves, their access ends and any credential they received is reset, even if the client relationship continues.

## When the link is the wrong tool

A one-time link delivers a value once. It is not a place to store anything, and it is not a substitute for proper access control. If the client's team needs ongoing access to a credential, that belongs in a password manager the client owns. If your platform supports inviting the client by email to set their own password, use that and skip the credential handoff entirely. The link is for the gap in between, and for every onboarding where that gap exists today.

## Related reading

- How to share credentials securely without email: https://uselinkpilot.com/blog/how-to-share-credentials-securely-without-email
- How to create a secure way to hand off credentials between teams: https://uselinkpilot.com/blog/how-to-create-a-secure-way-to-hand-off-credentials-between-teams
- Can you see who opened a one-time secret link?: https://uselinkpilot.com/blog/can-you-see-who-opened-a-one-time-link
- How one-time secret links work: https://uselinkpilot.com/blog/how-one-time-secret-links-work

## Tools for this article

One-Time Secret Link Generator

Share a password or note through a link that opens once.
https://uselinkpilot.com/tools/free-secret-link-generator

Self-Destructing Message

Send a note that disappears after one read.
https://uselinkpilot.com/tools/burn-after-read-secret

Expiring Link Generator

Create links that stop working at a set time.
https://uselinkpilot.com/tools/temporary-link

## Frequently asked questions

### Why not put the client's first password in the welcome email?

### What should go in a one-time onboarding link?

### How do you verify a new client contact before sending credentials?

### How long should a client onboarding link stay active?

### What if the client says the link was already opened?

### Should the client change the initial password?

## LinkPilot sends a secret link that is gone after it is opened.

Encrypted in your browser, revealed once, then destroyed. No account needed.

Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator)

## Read next

Security

### How to Share a Private Certificate Through a Secure Link Safely

Separate the certificate from its private key, package the key in a password-protected PFX, send it through a one-time link and send the password separately.
https://uselinkpilot.com/blog/how-to-share-a-private-certificate-through-a-secure-link-safely

Security

### How to Securely Deliver a Config File to a Developer

Split settings from secrets, send the secret values through a one-time link or an attachment that burns after one download, and keep the .env out of git.
https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer

Link Tracking

### Link Analytics With Geographic Click Data: What Location Tells You and What It Doesn't

How link analytics estimates the country, region and city of a click, how accurate that is, how to read the reports sensibly, and the privacy rules to follow.
https://uselinkpilot.com/blog/link-analytics-with-geographic-click-data

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Blog",
        "item": "https://uselinkpilot.com/blog"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "One-Time Credential Sharing for Client Onboarding",
        "item": "https://uselinkpilot.com/blog/one-time-credential-sharing-for-client-onboarding"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BlogPosting",
    "@id": "https://uselinkpilot.com/blog/one-time-credential-sharing-for-client-onboarding#article",
    "headline": "One-Time Credential Sharing for Client Onboarding",
    "description": "For agencies and MSPs: send the first login as a one-time link, share confidential onboarding instructions the same way, and record the handoff.",
    "datePublished": "2026-10-26",
    "dateModified": "2026-10-26",
    "image": "https://uselinkpilot.com/logo-512.png",
    "author": {
      "@type": "Organization",
      "@id": "https://uselinkpilot.com/author/linkpilot-team#organization",
      "name": "LinkPilot Team",
      "url": "https://uselinkpilot.com/author/linkpilot-team"
    },
    "publisher": {
      "@type": "Organization",
      "name": "LinkPilot",
      "url": "https://uselinkpilot.com",
      "logo": {
        "@type": "ImageObject",
        "url": "https://uselinkpilot.com/logo-512.png",
        "width": 512,
        "height": 512
      }
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://uselinkpilot.com/blog/one-time-credential-sharing-for-client-onboarding"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Why not put the client's first password in the welcome email?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The welcome email is forwarded to colleagues, archived by the client's IT and kept in your own sent folder. A password in it is readable by anyone with access to any of those for years. Send the password as a one-time link and keep the email for everything else."
        }
      },
      {
        "@type": "Question",
        "name": "What should go in a one-time onboarding link?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The credential, or the confidential instructions that would let someone act as the client: initial passwords, portal access codes, API keys, and any internal procedure you would not want forwarded. Welcome notes, schedules and public help links go in the normal email."
        }
      },
      {
        "@type": "Question",
        "name": "How do you verify a new client contact before sending credentials?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Use the contact details from the signed agreement or the kickoff call, not an address that appeared in a reply. If the request to send credentials came from a new address, confirm by phone with the person you already know."
        }
      },
      {
        "@type": "Question",
        "name": "How long should a client onboarding link stay active?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "An hour if you are on a call with them, 24 hours otherwise. The link also burns the first time it is opened. If it expires unused, create a new one after confirming they still need it."
        }
      },
      {
        "@type": "Question",
        "name": "What if the client says the link was already opened?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Treat the credential as exposed. Reset it, send a fresh one-time link, and check the audit timeline on a Pro account for the time of the first open. Then look at how the link travelled."
        }
      },
      {
        "@type": "Question",
        "name": "Should the client change the initial password?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes, on first login, through your platform's normal password change. The one-time link delivers the starting value; the client owns the credential from there, and you should not know the final one."
        }
      }
    ]
  }
]
```