WHMCS separates the client account that owns services from the users who log in to manage it. This lets a company invite staff or a developer without sharing the owner's password.
01 Grant access to the correct account
- Confirm the account owner's authorised request and the tasks the additional user needs to perform.
- Use the client's Users tab administratively, or ask the owner to use User Management in the client area.
- Invite the intended person and select the necessary account permissions. Avoid granting billing or user-management authority solely for a website task.
- Have the recipient accept the invitation through the documented process.
- Verify the final associated user and their permissions, then test access to the intended account and service.
- Record the purpose of temporary access and the date for reviewing or removing it.
02 Understand account selection
A user can be associated with several independent client accounts. They must select the intended account before viewing its services or tickets. Access to one account does not merge the businesses or establish authority over another account.
The account owner has the full set of client-user permissions and controls invitations where client-area user management is enabled. Treat an ownership transfer as a separate verified request.
Common questions
Is accepting an invitation the same as verifying an email address?
No. WHMCS treats invitation acceptance and email verification separately. Review the resulting association instead of relying only on the address to which the invitation was sent.
Why can a user log in but not see a service?
Check which client account is selected and whether the user has the required permissions for that account.
Should staff delete a user when one company removes access?
First review their other account associations. Remove the intended account relationship without unnecessarily disrupting authorised access elsewhere.
Use individual logins and two-factor authentication so access can be reviewed and revoked without changing a shared password.