Customer.io guest access: your agency's login, your send button

On 3 May 1943, the US Supreme Court struck down an ordinance in Struthers, Ohio. It made it unlawful for anyone handing out leaflets to ring a doorbell or knock to call a resident to the door. Martin, a Jehovah's Witness, had knocked on doors with invitations to a religious meeting. She was convicted in the Mayor's Court and fined $10.00 (Cornell LII; Wikipedia).

Justice Black's opinion turned on who decides. The city had "attempted to make this decision for all its inhabitants". The Court preferred rules "leaving to each householder the full right to decide whether he will receive strangers as visitors".

Your Customer.io account is your house. Since 12 July 2026, guest access lets you decide who comes in, what they may touch, and when they leave, without losing what they built.

TL;DR: Invite your agency to Customer.io as a guest on a custom role without the Execute permission, not on a shared login or a second login made for them. A guest signs in with the agency's own Customer.io login. Everything they do is attributed to them in your audit log, and removing them keeps what they built. Customer.io does not charge for team members, and guests are team members. Two limits decide whether this works: custom roles need a Premium or Enterprise plan, and a guest with Account Admin or "Manage API credentials" can send through the API whatever their role says. If your agency has no Customer.io account of its own, guest access is not available: invite a named team member instead.

Why outside access matters

Agencies, freelancers and contractors all need a way into your account. Each one is a door you have to watch.

Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30%. It analysed 12,195 confirmed data breaches, and credential abuse was one of the two leading ways in, at 22% (Verizon, 23 April 2025).

The UK's National Cyber Security Centre gives the matching advice for suppliers. Access to your systems should be "limited, controlled and monitored", and "on a 'least privilege' basis". These accesses "should be reviewed periodically, and removed when no longer required" (NCSC supply chain guidance).

A Customer.io account can email your whole customer base. Guest access, with the right role, is how you follow that advice without slowing your agency down.

What guest access is

A guest is a team member whose login belongs to another Customer.io account. The docs name who it is for: "someone from an agency, a contractor, or a teammate on a separate account" (Customer.io docs).

The agency signs in once, to its own main account. Your account then appears in its account switcher, next to every other client that has added it (Customer.io docs). While it works in your account, the app behaves as though it were one of your team members.

Three details matter for you as the host:

• Permissions belong to your account. The agency's role in its own account does not carry over. You set the guest's access.
• Region does not matter. A login in a US account can be a guest in an EU account, and the other way round.
• Cost is zero. The docs do not say whether guests count towards the 300 team member limit.

The release note puts the model in one heading: "Permissions stay per account".

Inviting a guest

To invite a guest, you must be able to manage team members, which by default means an Account Admin.

1. Go to Account Settings > Team Members and click Invite a guest.
2. Enter the email address the person uses for their own Customer.io account.
3. Set an account-level role (Account Admin or Member) and a role for each workspace.
4. Send the invitation. It expires after seven days.

A guest who is not an Account Admin needs access to at least one workspace. Pending invitations show a "Guest invite sent" status, and you can filter the Team Members list to guests only.

Three ways in

Before guest access, agencies kept a separate login for each client, often an aliased address like [email protected], or shared a password. The docs say guest access "replaces that pattern".

	Guest	Dedicated team member	Shared login
Cost	Free	Free	Free
Login in your account	None: the agency uses its own	An address and password you created	One password several people know
Audit trail	Every action under the named guest	Every action under the named login	One name for several people
Sending rights	Set per workspace by your role	Set per workspace by your role	The same for everyone using it
Two-factor	Signs in through the agency's main account	Your 2FA policy applies	One inbox or device, shared
Offboarding	Remove the guest: their work and audit history stay; the guest can also leave	Delete the team member: their work stays	Change the password and every other way in

A shared login fails on the rows that matter: one password behind Customer.io's same-device two-factor link, and one name in the audit log for several people. Our agency onboarding guide covers the two-factor detail.

Between the other two, the guest wins on the login itself: no extra address or password lives in your account. The dedicated team member still has one use, covered under When not to use it below.

A no-send role

Guest access decides who comes in. The role decides what they can do once inside.

Since 10 July 2026, custom roles separate building from sending (Customer.io release note). The switch is the Execute permission (Customer.io docs):

• Automations: Execute lets someone "Start, schedule, and stop automations".
• Broadcasts and one-time sends: Execute covers sending, scheduling and stopping, including API-triggered broadcasts.
• Transactional messages: Execute lets someone send them.

The setup is simple. Create a custom role with Edit and Create on automations, broadcasts and Design Studio, and leave Execute unticked. Invite the agency as a guest with the Member account role, and assign that role on each workspace it builds in.

Two details change how this feels in practice. Editing a live automation also needs Execute, so a no-send guest cannot fix a live automation either. And custom roles created before 10 July 2026 keep their old permissions unless you edit them. If you set up an agency role earlier, open it and check.

Our post on the Customer.io Execute permission covers the permission itself in more depth.

The plan boundary

Custom roles are a Premium and Enterprise feature. On any other plan you assign one of three standard roles: Workspace Admin, Author or Viewer (Customer.io docs). Viewer is view-only, and none of the three builds without sending. The release note explains why: "Previously if you could create an automation or broadcast, you could also activate that automation or send that broadcast." Below Premium, guest access still gives you named logins and clean offboarding, but not the no-send split.

Where the role leaks

A no-send role is only as tight as the permissions around it. The announcement leaves out five gaps, all in the docs.

API keys

The roles page is blunt: "Each key gives you access to the complete API, regardless of permissions set on your custom role." Creating Track and App API keys needs the account-level permission "Manage API credentials". Sending a transactional message needs an App API key. So a no-send guest must not hold "Manage API credentials".

Pipelines keys

The Edit permission for Integrations is enough to view and copy Pipelines API keys, without "Manage API credentials". Every key reaches the complete API, and the docs' own example is sending events without People permissions. Events can trigger automations (Customer.io docs), so a guest holding a Pipelines key can send the event that starts a live automation. Leave Integrations Edit off the production role unless the agency is wiring data.

Account Admin

Account Admins "automatically get full access to every workspace". A guest invited as Account Admin can send, whatever custom role you meant to apply. Invite as Member.

Publish

The Design Studio Publish permission can "Push message and design updates to messages connected to workflows like automations." A guest with Publish can change what a live automation sends without pressing start. Leave it off if you want to approve copy changes to live messages.

Drafts

The automation Edit permission lists "Send or delete drafted messages", and Deliveries & drafts has its own Send permission. If any automation queues drafts, check both.

One point cuts the other way. Without Execute, the guest also cannot stop an automation. If something misfires at night, someone on your side has to hold Execute and be reachable. Name that person before launch.

Setup needs more

The first weeks are different. Domain records, API keys and integrations sit behind permissions a no-send role does not have. Our agency onboarding guide explains why we ask for Account Admin during setup: API credentials and the account region sit with Account Admins.

So treat access as two phases. Give the agency what setup needs. Once the domain is verified and the data flows, edit the guest down to Member on the no-send role. Permission changes take effect immediately, and Customer.io does not notify team members when they change. Tell the agency first, or they may lose unsaved work.

There is a second way to give room. A team member "can only have one role per workspace", but different roles in different workspaces. A guest can be Workspace Admin in a test workspace and on the no-send role in production. Our test workspace guide covers that setup.

The audit trail

Customer.io keeps two audit logs, both for Account Admins (Customer.io docs). The account log records security events such as sessions, permission changes and API key deletions. The workspace log records changes made to the workspace, including imports and exports.

Everything a guest does in your account is attributed to them. The CSV export carries the team member's email and IP address for each activity, so a guest's work is easy to isolate.

Plan	View and filter	Export
Essentials	The past 30 days	The past 30 days
Premium or Enterprise	Any time period	Up to the past year

There is no API for audit logs, so an export is a manual CSV. On Essentials, export at the end of each month you want to keep.

AI agents show up too. An action taken by Customer.io's agent in the app is attributed to the agent and to the person who asked for it. If your agency works through an agent, see our MCP server playbook.

Removing a guest

Remove a guest from the Team Members page, the same way you remove anyone. Customer.io removes their membership, permissions and workspace roles in your account. It keeps the resources they created and the audit history of their actions, and leaves their own login and other client accounts alone (Customer.io docs).

Deleting a team member is also the documented way to end their active sessions in your account (Customer.io docs).

Deleting a dedicated team member keeps their work too: the docs say anything a team member did remains after you remove them. The difference is the login. A guest leaves no address or password behind in your account, and guests can leave your account themselves at any time. Our post on consulting hand-overs covers what else should stay behind.

Two checks belong on the last day. First, revoke any API keys made for the engagement: removal keeps what a guest created, and the docs do not single out keys. Second, export the audit log for the engagement while your plan still shows it.

You cannot remove the last person who can manage team members. If the agency is your only Account Admin, add one of your own first.

Two-factor and SSO

Customer.io requires two-factor authentication for everyone who signs in with a Customer.io password rather than SSO (Customer.io docs). An Account Admin can require an authenticator app for all team members.

A guest signs in through their own main account. The docs do not say whether your authenticator-app requirement or your SSO setup applies to a guest. They do say Google Workspace SSO lets in only team members who are in both your Google Workspace and Customer.io. Test a guest's sign-in before you rely on either.

Until then, ask the agency in writing how its main login is protected: an authenticator app, or SSO with two-factor at its identity provider. The Team Members table shows whether 2FA is on for each person, so check the guest's row.

When not to use it

Guest access is the default for an agency, not the answer to every case.

• The agency has no Customer.io account. Anyone you invite as a guest "must already have their own Customer.io account". If not, invite a named team member with an authenticator app.
• Your plan has no custom roles. The guest still gets a named login and a clean exit, but on a standard role. Decide how far you trust the agency to send.
• You need the agency to send on day one. A no-send role makes you the go-live step. If nobody on your side can press start this week, grant Execute on purpose and take it back later.
• Someone outside your company is the only Account Admin. Fix that first.

For who should run the work at all, see agency vs freelancer vs in-house.

Partner-created accounts

A partner account is a Customer.io account flagged for agencies that manage client accounts. Partners can create client accounts, and the docs say the partner is "automatically added to each account you create as an Account Admin". The client's owner gets an invitation to set up their own login.

If your agency created your account, it was added as an Account Admin automatically. Accept your own invitation, make sure you hold Account Admin, then edit the agency down.

Customer.io can also grant or revoke a partner's guest access on the backend, with no email invitation. So read the Team Members page, filtered to guests, rather than your inbox.

Account check

Run this on your Team Members and Roles pages:

• Guests: every outside person is a guest or a named team member, never a shared address.
• Account role: every agency guest is a Member, outside an agreed setup phase.
• Workspace role: production uses a custom role with Execute unticked, and Publish off where you approve copy.
• API credentials: no agency guest holds "Manage API credentials", or Integrations Edit in production, outside setup.
• Execute holder: someone on your side can stop an automation out of hours.
• Old roles: any custom role made before 10 July 2026 has been checked.

If several rows fail, a Customer.io audit covers access alongside automations, data and deliverability. Our Customer.io agency page sets out how we work, and you can book a call with David to go through your Team Members page together.

FAQ

What is guest access in Customer.io?

Guest access lets someone sign in to their own Customer.io account and switch to yours, without a second login. It shipped on 12 July 2026. You set the guest's permissions, and their actions appear in your audit log.

Does a Customer.io guest cost anything?

No, a guest costs nothing, because the docs define guests as team members and Customer.io does not charge for team members. The docs do not say whether guests count towards the 300 team member limit.

Who can invite a guest to a Customer.io account?

Anyone who can manage team members can invite a guest, which by default means an Account Admin. The person you invite must already have their own Customer.io account, and the invitation expires after seven days.

What happens to an agency's work when I remove it as a guest?

Removing a guest keeps the resources they created and the audit history of their actions. Their membership, permissions and workspace roles in your account go, and their own login is untouched.

Can I stop my agency sending messages from Customer.io?

Yes, on Premium and Enterprise plans you can give the agency a custom role without the Execute permission. Keep the agency off Account Admin and "Manage API credentials" too, because API keys ignore the role.

How long does Customer.io keep the audit log?

On Essentials you can view and export the past 30 days. On Premium or Enterprise you can view any time period and export up to the past year.

Should my agency be an Account Admin in Customer.io?

Only while setup needs it. Account Admins get full access to every workspace, including sending, so move the agency to Member with a no-send custom role once the domain and data are in place.

Sources

• Customer.io, Access multiple accounts, updated 22 October 2026, read 2 November 2026.
• Customer.io release note, Manage all your accounts with a single login, 12 July 2026.
• Customer.io release note, Custom roles: determine who can send messages, 10 July 2026.
• Customer.io, Create & assign custom roles, read 2 November 2026.
• Customer.io, How to add team members to your account, read 2 November 2026.
• Customer.io, Assign standard roles, read 2 November 2026.
• Customer.io, Events: track activities for people, read 2 November 2026.
• Customer.io, Audit logs, updated 27 October 2026, read 2 November 2026.
• Customer.io, Two-factor authentication, read 2 November 2026.
• Customer.io, Single sign-on (SSO), read 2 November 2026.
• Verizon, 2025 Data Breach Investigations Report press release, 23 April 2025.
• National Cyber Security Centre, Supply chain security guidance: II. Establish control, reviewed 22 October 2025.
• Cornell Legal Information Institute, Martin v. City of Struthers, 319 U.S. 141, read 2 November 2026.
• Wikipedia, Martin v. City of Struthers, read 2 November 2026.