No. An agency should not sign in to your personal LinkedIn account, with your password or with your cookies.
LinkedIn's User Agreement (effective November 3, 2025, checked September 2026) puts this on the list of things every member agrees not to do: "use or attempt to use another's account (such as sharing log-in credentials or copying cookies)".
An agency that signs in as you is using another member's account. What your contract with that agency says does not change the wording.
What stays within the rules: the agency builds the list, writes the copy and drafts the replies. It can hold an admin role on your Company Page. Outreach can go out from real people's own profiles. And if the messages must come from your personal profile, you are the one signed in when they go out.
Below: each kind of access an agency might ask for, what LinkedIn's pages say about it, and what to settle before you sign. This is not legal advice. Every LinkedIn page quoted here was checked in September 2026.
What LinkedIn's rules actually say
Section 2.2 of the User Agreement is short: "You will keep your password a secret. You will not share your account with anyone else and will follow our policies and the law."
The Don'ts list quoted above goes further. It names cookies, which covers the version where nobody types your password: a tool or browser that holds your session for them.
Two more lines matter for a founder. The first: "You are responsible for anything that happens through your account unless you close it or report misuse." If messages an agency sent from your profile get reported, that clause makes them your problem.
The second is about ownership: "As between you and others (including your employer), your account belongs to you."
Even when an employer pays for a LinkedIn service you use at work, such as a Recruiter seat, the agreement says the payer controls that paid service but does "not have rights to your personal account".
Enforcement is at LinkedIn's discretion. It "reserves the right to restrict, suspend, or terminate your account if you breach this Contract or the law or are misusing the Services". No threshold is written into that clause.
Why agencies ask for your login anyway
Running outreach from your own profile, with someone else at the keyboard, is sometimes called "LinkedIn spoofing". Agencies ask for it because prospects trust your profile more than a stranger's. A message from the founder, with a real network behind the name, gets read differently.
The same cold message landed a 2% reply rate for one B2B company and 7.5% for another. The difference was the sender, not the words. So the pull toward your profile is real.
That is also the problem. Your profile is where buyers check you after a message lands, and it holds your network and your conversations. Handing it over puts all of that under someone else's habits.
Every kind of access, checked against LinkedIn's pages
The middle column is what LinkedIn's own pages say (all checked September 2026).
| What the agency asks for | What LinkedIn's pages say | Verdict |
|---|---|---|
| Your password, "just to set things up" | User Agreement 8.2 names "sharing log-in credentials"; section 2.2 says you "will not share your account with anyone else" | Against the rules |
| A logged-in browser profile, an extension or a cloud tool that keeps your session | User Agreement 8.2 names "copying cookies"; the restrictions page says LinkedIn does not allow software that will "automate activity on LinkedIn's website" | Against the rules |
| A new profile under your name, or a made-up persona they run | User Agreement bans creating "a Member profile for anyone other than yourself (a real person)"; the duplicate accounts page says "Creating multiple profiles is not allowed" | Against the rules |
| An app you connect to your own account | Connected third parties show under Partners & services in your settings; any software that automates activity on the website falls under the same ban | Depends on what the app does, so ask |
| An admin role on your Company Page | LinkedIn offers Page admin roles (super admin, content admin, analyst, paid media roles), granted to members | Allowed |
| Outreach from a real person's own profile, theirs or your team's | Each member uses their own account; 8.1 and 8.2 require a real name and an accurate identity, so the sender cannot present themselves as someone they are not, such as your employee | Within the account rules; the automation rule still applies |
| Everything except the sending: list, copy, reply drafts, while you send | Your login never leaves you | Within the account rules |
Three rows are clear breaches. The app row needs the hardest questions, because "we just connect a tool" can mean a calendar link or software that sends for you.
The last two rows are the honest trade. Either prospects see someone else's real profile, or they see yours and you do the sending yourself.
What two-factor authentication does to a one-time handover
A password handover sounds like a one-time favor. With two-factor authentication on, it cannot stay one.
LinkedIn's two-factor authentication page explains the flow. When LinkedIn does not recognize the device, sign-in asks for the password and then a numerical code sent to your phone by text or authenticator app.
So the agency's first login needs a code from your phone. So does every new laptop, new team member and server a tool runs on. The shared password becomes a standing request to your phone.
If you use Sales Navigator, two-factor has to stay on: the same page says LinkedIn requires it for "Recruiter, Campaign Manager, and Sales Navigator users".
Each of those logins also leaves a trace. The Where you're signed in page lists every active session with its location, IP address and device type. An agency's sessions would sit in that list next to yours, with their location instead of yours.
Now read that from LinkedIn's side. Its restrictions page says it may restrict an account "if we find signs that your account has been compromised or taken over by another person or entity". From the outside, a helpful agency and an intruder can look the same.
One pattern I have watched come before restrictions matches this: the same account active in two places at once, with a cloud tool signed in from one country while its owner works from another.
Two others show up more often: acceptance rates collapsing, and members reporting the messages. Whoever runs the volume on your profile drives both, and both land on the account that sent them.
If LinkedIn restricts the account
The restrictions page says access "may be restricted either temporarily or indefinitely", depending on the type of violation. It groups restrictions into content, profile, identity and automated tools violations.
The way back runs through LinkedIn, on its process and its timing: you log in and follow the on-screen steps, including identity verification where that applies.
Opening a second profile to keep the outreach going is not a workaround. LinkedIn's duplicate accounts page is explicit that multiple profiles are not allowed, so the new profile is a second breach on top of the first.
What is at stake is the profile prospects, clients and partners look you up on, plus every conversation in it.
How outreach reaches more people without borrowing your identity
Reach is one reason agencies give for wanting your login. The answer is more sending profiles and a second channel: horizontal scaling means adding LinkedIn or email accounts to a structure that already works. Under LinkedIn's rules, each profile belongs to a real person who uses it.
One profile done properly carries a lot, more than LinkedIn's weekly invitation cap suggests. A client of mine got this from a single LinkedIn profile in 30 days, running LinkedIn with email follow-ups: 1,200 people contacted, 289 replies, 16 calls booked, 12 showed, 3 signed contracts so far.
I shared those numbers in a 2024 post and broke down the list math behind them on the Journal.
That 2024 post named the next step: scale "by using more LinkedIn profiles and replicating the same structure".
When several profiles send, give each one its own territory, so no prospect sits on two lists. Split by segment, country or named accounts, and write the split into the list file.
One prospect hearing from three of your people in the same week looks like a machine, and that is the kind of outreach people report.
Questions to settle with any agency before you sign
Smirnov Consulting Group is a Prague-based B2B outbound lead generation agency that runs cold email and LinkedIn campaigns for founder-led B2B companies and books qualified sales calls. The questions below are ones to put to any agency on your shortlist, mine included.
- What access do you need, exactly, and what stops working if we say no? A clear answer names one row from the table above.
- Whose name will prospects see on the messages? If it is yours, ask who presses send. The setups that hold up when someone else sends are a rep on their own profile, or drafts you send yourself.
- Will anyone other than me ever sign in to my personal account? Under the User Agreement, the answer should be no.
- What software touches my account or my profile's data, and does any of it automate activity on LinkedIn's website? Get the tool names in writing.
- Who writes each message, and who handles replies? In my checklist for hiring an agency I wrote: "The person selling you is rarely the person doing the work, so ask who that person is and what else they are running this month."
- If more than one profile sends, how is the market split? Ask to see the split in the list.
- What happens to access on the last day? Page roles removed, apps disconnected, sessions ended. Your account "belongs to you" under the User Agreement, and so should the conversations in it.
These cover access only. For the rest of the engagement, from data sources to reporting, use the longer checklist for hiring a lead gen agency.
Already gave someone your login? Close it in this order
Steps from LinkedIn's help pages, checked September 2026.
- Change your password. On the change password page, tick "Require all devices to sign in with new password" so every other device is signed out.
- End old sessions. Open Where you're signed in and use "Sign out of all these sessions". Check what is left for locations you do not know.
- Review connected apps. Go to Partners & services under Account preferences and remove anything you did not set up yourself.
- Turn on two-factor authentication. LinkedIn recommends the authenticator app over text messages.
- Check your Company Page admins. A super admin can add and remove any type of admin, so remove roles nobody needs anymore.
- Report misuse if messages went out that you did not approve. Under the User Agreement, you stay responsible for account activity unless you close the account or report misuse.
Short answers to common access questions
Is it against LinkedIn's rules to give an agency my password?
Yes. The User Agreement gives "sharing log-in credentials or copying cookies" as examples of using another's account, and section 2.2 says you will not share your account.
Can an agency post on LinkedIn as me?
Not by signing in to your personal profile, which the User Agreement rules out. The clean version is that they draft and you publish. On your Company Page, a content admin role lets them create and manage posts.
Does Company Page admin access carry the same risk as sharing my profile?
No. Page admin roles, such as content admin or analyst, are a defined set of permissions on the Page. Nobody uses your login, and a super admin can remove the role.
Is it fine if the agency signs in through a password manager and never sees my password?
No. Sharing a login through a password manager is still sharing log-in credentials, and the agency is still using your account, which the User Agreement rules out. Its sessions would also show up in your Where you're signed in list.