Can an agency manage a client's Instagram without their password?

Yes, and it should. The client can sign in on Meta's own login screen to connect their account to your tool, or add your team to their Meta business portfolio. Either way you get access to posting and messages without ever seeing their password or needing their two-factor codes.

Sharing a password causes problems that show up later: two-factor codes sent to the client's phone at 9pm, Instagram flagging logins from a new location, and no clean way to remove access when the contract ends.

The better options:

• Let the client connect their account. Most social media tools can send the client a link. They open it, sign in with Meta themselves and approve access. Your team can then post and reply without ever knowing the password. In Inexra this is the client connect link under Settings, Integrations.
• Use Meta's business access. The client adds your agency to their business portfolio in Meta Business Suite and gives your people only the access they need.

Both can be removed by the client in one step, which is a selling point when you onboard someone cautious. Write down in the onboarding notes which method each client used, so offboarding takes minutes, not a hunt through old emails.

The full method is in How to Manage Instagram DMs for Multiple Clients Without Missing the Ones That Pay.