> For the complete documentation index, see [llms.txt](https://help.branch.io/llms.txt).

# Manage Third Party Access

Third-party partners often manage campaigns, links, and reporting on your behalf. In Branch, these partners work from their own third-party account, and you control which of your apps they can reach and what they can do in each one.

This guide covers how to connect a third party to your app, set its access level and permissions, restrict the data it can see, and disable its access when a partnership ends.

For what third parties are and how access works, see [Third Party Overview](https://help.branch.io/marketer-hub/third-party-overview.md).

> **Note**
>
> Third parties were previously called agencies. If you’ve used agency access in Branch before, this is the same idea, rebuilt.

## About third-party access

Here’s how third-party access works end to end:

- You invite a third-party organization to your app, not an individual person.
- The person you invite creates the third party’s Branch account and becomes its first admin.
- That admin adds their own teammates and assigns them to your app.
- Everyone they assign gets the permissions you granted the organization.
- You can change those permissions or disable access at any time.

Two details matter throughout:

- **Access is per app:** Connecting a third party to one app gives it nothing in your other apps. To give the same third party access to a second app, repeat these steps from that app.
- **A third party can only see what you grant:** A partner that works with several Branch customers can reach only the apps it’s been granted.

## Remove access for one person

You grant access to a third-party organization, not to individual people, so you can’t remove one person’s access from your side. Everyone the third party assigns to your app gets the permissions you granted the organization.

- To cut off one person, ask your contact at the third party to remove them or unassign them from your app.
- To cut off the whole organization, disable its access. See [Disable a third party’s access](#disable-a-third-party-s-access).

## Before you begin

To connect a third party to your app, you first need to:

- Get admin access to the app in Branch.
- Find the third party’s name, or the business email of the person you work with there. Public email domains such as Gmail and Yahoo aren’t supported.

## Connect a third party to your app

1. Go to **Configuration > Security & Access** in Branch.
2. Select the **Third Party** tab.
3. Select **Connect a third party**.
4. Search by third-party name or email. For privacy, Branch doesn’t list every third party, so you have to search.
5. Select **Manage** on the organization you want, or select **Invite new third party** if it isn’t listed.
6. Enter the **Third Party Name** and **Third party representative email** if you’re inviting a new third party.
7. Select an **Access level**, then adjust individual permissions and data restrictions.
8. Confirm the invitation.

Branch emails the invitation from “Branch Alerts.” The third party appears in the **Third Party** list with the date invited and who invited it. Once the person you invited creates their account, the status shows **Active**.

Your contact receives instructions for creating their account. If they have questions about setup, point them to [Create Your Third Party Account](https://help.branch.io/marketer-hub/create-your-third-party-account.md).

> **Note**
>
> The person you invite becomes the first admin of the third party’s Branch account. They then add their own teammates and assign them to your app, so choose a contact who can manage that.

## Set the access level and permissions

You set access when you first connect a third party, and you can change it at any time afterward.

1. Go to **Configuration > Security & Access > Third Party** in Branch.
2. Select the **⋮** menu for the third party, then select **Manage permissions**.
3. Select an **Access level**.
4. Adjust individual permissions.
5. Select **Save permissions**.

The access level sets a starting point that you can fine-tune below it.

| Access level | What it means |
| --- | --- |
| Full access | This third party has full access to the app, including settings, integrations, and user access. |
| Limited access | This third party can view and edit selected features based on assigned permissions. |
| View only | This third party can view data and settings but can't make changes. |
| Custom | Customize access for this third party by selecting specific permissions. |

Each feature has up to two checkboxes.

| Selected | What the third party can do |
| --- | --- |
| **Edit** | Everything in the feature, including creating and managing |
| **View** | Read-only |
| Neither | Nothing — the feature is hidden from them |

Reporting permissions are view-only. Exporting has a single **Allow exports** option. Select **Grant full access** on a category to turn on everything in it at once.

> **Caution**
>
> Some permissions may already be turned on when you open this page. Review every category before saving rather than assuming a category is off.

| Category | Permission | What it controls |
| --- | --- | --- |
| Campaign execution | Links | Create and manage short links for this app. |
| Campaign execution | Link templates | Create and manage saved link templates for consistent link creation. |
| Campaign execution | Channels & ad partners | Configure ad partners and postbacks. |
| Audience & engagement | Engagement audiences | Create, manage, and export audience groups. |
| Audience & engagement | Mobile Discovery | Access and manage Mobile Discovery settings and data. |
| App configuration | App settings | View or modify app-level configuration. |
| App configuration | Fraud rules | Create and manage fraud detection rules. |
| Reporting & insights | Summary reporting | Access high-level performance reporting. |
| Reporting & insights | Fraud reporting | Access fraud-related reporting. |
| Reporting & insights | Revenue data | Access revenue metrics and reporting. |
| Reporting & insights | Sensitive data | Access user identifiers and other sensitive fields. |
| Exporting | Export data | Allow exporting data from reports and pages the third party can view. |

Features a third party doesn’t have permission for don’t appear in its navigation, and it can’t reach them by URL either.

> **Tip**
>
> Grant the minimum access the third party needs. You can expand permissions later as its responsibilities grow.

## Restrict the data a third party can see

The **Data restrictions** section of **Manage permissions** limits what a third party sees, separately from its feature permissions. Select **Limit** to choose what it can see, or **Show all** to remove the restriction.

| Restriction | What it does |
| --- | --- |
| Only show data relevant to this third party | The third party sees only events tagged to it. |
| Limit to selected ad networks | The third party sees only data from the ad networks you select. |
| Limit to selected countries | The third party sees only data from the countries you select. |

Assets a third party creates in your app, such as Branch Links, are tagged to it. That tagging drives the first restriction.

> **Caution**
>
> “Only show data relevant to this third party” hides everything the third party isn’t tagged on, including links and campaigns your own team created. Use it when the third party works only with its own assets.

## Disable a third party’s access

Disable a third party when a partnership ends or you need to cut off access quickly:

1. Go to **Configuration > Security & Access > Third Party** in Branch.
2. Select the **⋮** menu for the third party.
3. Select **Disable access**.

Access ends immediately for everyone at that third party. Disabling doesn’t delete anything: links, audiences, and other assets the third party created stay in place and keep working, and data already tracked is unaffected. Because access is scoped per app, disabling here doesn’t affect any other app the third party works on, including your own other apps.

## Follow security best practices

- Grant the minimum access a third party needs, and review connected third parties periodically.
- Disable access as soon as a partnership ends.
- Remember that third-party users sign in with a business email address. Public email domains such as Gmail and Yahoo aren’t supported.
- Sensitive account information, such as your billing details, isn’t visible to third parties.

For anything you can’t resolve from the **Third Party** tab, contact [support@branch.io](mailto:support@branch.io).