Short answer: in most cases a UGC creator doesn't need a brand's password. The brand either posts your video itself, runs it as a Spark Ad from your own account with an authorization code, or grants access through TikTok Business Center. If a brand does want you to post directly, agree in writing on who holds the login and the two-factor codes, and hand everything back when the work ends.
Four ways to get your video onto a brand account
| Option | Who posts | What you share | Good for |
|---|---|---|---|
| Deliver files | Brand | Video files and captions | Most UGC deals |
| Spark Ads code | You, on your account; brand promotes it | An authorization code | Paid promotion of your post |
| Business Center access | Brand's team via granted permissions | Nothing personal | Agencies and larger brands |
| Direct login | You, on the brand's account | Brand shares credentials | Small brands without a team |
Spark Ads codes
With Spark Ads, the brand promotes a post that lives on your account. TikTok's Spark Ads guide (as of 17 September 2026) describes the creator side as: open the video, tap the three dots, tap Ad settings, then Generate to get the code. The brand adds the code in Ads Manager. Full walkthrough in Spark Ads codes for creators.
Business Center permissions
TikTok's help page on managing TikTok accounts in Business Center (as of 17 September 2026) describes two permission levels. "Deliver ads" lets a user or ad account use a TikTok account's identity and posts for paid campaigns, most notably Spark Ads. "Manage account" includes that and adds organic actions such as replying to comments, sending messages and managing profile details. Ask the brand which level they want to grant before you share anything.
If you do post directly
Some small brands just hand over the login. If you accept:
- Get it in writing: which accounts, what you may post, and when access ends.
- Keep two-factor authentication on. Agree who receives the codes; the brand should keep control of the recovery email and phone number.
- Use a password manager shared by the brand, not a message thread.
- Don't change account details such as the email, phone or username.
- Log out and tell the brand when you're done so they can change the password.
Never buy, sell or transfer accounts, and never post as a brand without its clear agreement.
Keeping clients separate
If you post for several brands, keep a sheet: account, client, access type, who holds 2FA, access end date. Double-check which account is open before every post; posting a client's video to the wrong brand is the costly mistake here. For scheduling several clients, see UGC deliverables schedule.
Posting for clients with Farmero
If a brand has asked you to post directly and the account is signed in on one of your iPhones, Farmero reads the profile header on screen before posting to confirm it is on the right account, and stops rather than guessing if it can't. Each account is added by you in the app. Automating these apps may breach their terms, so agree with the brand before using any automation on its account. See adding accounts.
FAQ
Do I have to give a brand my TikTok password for a Spark Ad?
No. A Spark Ad uses an authorization code you generate on your own post; the brand never needs your login.
How can a brand let me post without sharing the password?
Brands can grant permissions through TikTok Business Center, or simply post the files you deliver themselves.
Who should control 2FA on a brand account?
The brand. It should own the recovery email and phone number, whoever does the posting.
Can I keep access after a contract ends?
You should hand access back and ask the brand to change the password when the work ends.