How to give Search Console access: which permission to ask your client for

How to give Search Console access in 4 steps (without sharing your password)

The direct answer, before the details: the property's owner goes to Settings → Users and permissions → Add user, types the other person's Google account email, and picks a permission level. That's it. Only someone who is already an owner can do this, so if a client says "I can't find that option," the first thing to check is whether they're actually an owner or only have Full access.

Before the steps, a habit worth breaking: in a lot of small businesses across Latin America, giving Search Console access still means "here's the email and the password to the business's Gmail." It's the fastest way to lose control of the entire account — not just Search Console, but the inbox too, plus Google Ads and Google Business Profile if they exist — and it's never necessary. Search Console has had its own user system for years.

1. Step 1 · Sign in to the property as an owner

   From search.google.com/search-console, pick the property (Domain or URL prefix) from the selector on the left. You'll only see the option to add users if your account already has owner level on that specific property.

2. Step 2 · Go to Settings → Users and permissions

   The gear icon is usually at the bottom left of the menu. That's where you'll see the full list: who has access today, at what level, and — for owners — which verification method each one used.

3. Step 3 · Click Add user

   Type the person's exact Google account email (it doesn't have to be a Gmail address, but it does need to be registered with Google) and choose Restricted or Full. Owner level is granted in a separate step, by promoting a user already on the list.

4. Step 4 · Confirm and have them check their access

   The other person sees the property appear in their own Search Console as soon as you confirm. Ask them to log in and confirm they can see what they need — it's the fastest way to catch a permission level that's wrong.

The same steps work in reverse when an agency has to hand access back to a client once a project wraps up. The direction changes; the procedure doesn't.

Search Console permission levels: verified owner, delegated owner, Full, Restricted, and Associate

Search Console recognizes five access levels, and the difference between them isn't cosmetic — it defines what each person you share the property with is able to break. Worth understanding before asking for, or granting, any of them.

The rule that falls out of this list, and that almost nobody applies: Owner isn't the "trust" level, it's the "risk" level. Every owner you add can, among other things, remove every other owner. Nobody needs Owner just to see numbers.

Which permission to ask your client for, based on the work you'll actually do

This is the least-privilege principle applied to Search Console: ask for the level today's task needs, not the level that would save you from asking again in three months. If you're only going to read and report, Restricted is enough. If your contract includes executing technical changes — submitting sitemaps, requesting URL removals, requesting indexing — you need Full. Owner should only be requested for tasks that genuinely require it, like linking Google Analytics or using Change of Address during a domain migration, and it's worth stepping back down to Full as soon as that task is done.

With read-only access you can already build most of a report: review the full Performance data, see each client's Search Console alongside the positions you track by city and device, and use URL Inspection to diagnose. That's the level worth asking for when you sign a new client. For organizing one project per client and splitting your quota across several, there's a guide on setting up one project per client and splitting your quota, which we won't repeat here.

Table source: Search Console's official help, checked on September 10, 2026. Save it, or forward it straight to your client next time they ask "so which one do I give you?"

Adding a user in Search Console when the client has no idea where anything is

In practice, the step that stalls the most isn't technical — it's that the business owner has never opened Search Console, doesn't know what "Settings" means, and gives up before finding the button. A short message with the exact path, no jargon, does more than any screenshot.

If the site has two properties — a Domain one (covers http, https, www, and subdomains all at once) and a URL-prefix one (only that exact version, like https://www.business.com/) — ask them to add you on the Domain property if it exists: it's the one that gives you the full picture. If only the URL-prefix property exists, that's what you work with.

The three most common trip-ups, in order of frequency: the email they hand you isn't registered as a Google account (the invite just sits pending, unnoticed); they add a group or distribution-list email, which Search Console doesn't accept; or you get added to the wrong property because the site has both and nobody checked which was which.

Once they confirm, log in yourself: under Settings → Users and permissions you'll see your own email on the list, with the exact level shown in the permission column. Don't take anyone's word for it, including your own from a month ago — confirm the real level every time you start relying on that access for something new.

The most common case: the provider who built the site is still the verified owner

This is the scenario that shows up the most when a new agency or freelancer joins a project: the site was built by someone else one, two, or three years ago, that someone verified the Search Console property with their own account, and the business owner never touched it again. Today that provider is still, technically, the owner of the property — even if they no longer work with the client, even if they don't answer the phone, even if the relationship ended a long time ago.

How to spot it: go to Settings → Users and permissions and look at the list of owners and, next to each one, their verification method. If the only verified owner is an email you don't recognize — an outside agency, a freelance developer, a generic address like webmaster@ — that's the case.

Why this is a real risk: that owner can remove every other user at any moment, submit sitemaps, and request full URL removals from the index. It's the exact reason "here's the email and the password" ends up costing months of SEO work when something goes wrong.

The rule that solves most cases: if you control the domain or the site, you don't need anyone to "hand over" Search Console. You can verify yourself with a method you control — a record in your own DNS, for example — without depending on the previous provider cooperating. The exact steps are in the next section.

There's a case that complicates this further: if the domain or DNS is also registered under the provider's name (it happens more than it should), you first need to reclaim control of the domain through the registrar, with whatever documentation that registrar requires. That's a separate process, with a different provider and different rules, and it's not legal guidance that fits in one paragraph of this post — if that's your situation, start there before touching Search Console.

1. 1. Confirm who controls the domain, the DNS, and the hosting

   Before touching Search Console, verify that the client (or you, on their behalf) has real access to the domain registrar, the DNS panel, and the hosting or platform the site runs on. Without that you can't complete step 2.

2. 2. Add the property and verify yourself with a method you control

   Using the business's Google account, add the property (or open the existing one if it already shows up) and complete verification with your own method: a DNS TXT record for a Domain property; an HTML tag, an HTML file, Google Analytics, or Google Tag Manager for a URL-prefix property. This step makes you a verified owner without needing anything from the previous provider.

3. 3. Review the full list of owners and their verification methods

   In Users and permissions, now that your own access is active, check who else shows up as an owner and how each one is verified. You'll need this list for the next step.

4. 4. Delete the previous owner's tokens

   This is the step almost everyone skips, and it's why the previous provider tends to reappear weeks later. Check and remove: any leftover google-site-verification meta tag in the theme or SEO plugin, the HTML verification file at the site's root, the DNS TXT record under their name, and their editing permissions in Google Analytics or Tag Manager if that's how they verified.

5. 5. Remove their access, and that of any delegated owners they added

   With your own tokens active and theirs already deleted, remove them from Users and permissions. Also check whether they added anyone else as a delegated owner or user, and decide with the client who stays.

6. 6. Check the list again a few days later

   If the previous provider shows back up as an owner, a token you missed in step 4 is still alive — most often a meta tag in a template that never got touched, or a separate verification field in an SEO plugin. Go back to step 4 and dig deeper.

There's no faster legitimate shortcut. Any offer of "I'll transfer the property to you" from a provider who's no longer cooperating is, at best, this same procedure done from their end.

Removing access in Search Console: the exit checklist when a contract ends

Getting access right at the start matters as much as removing it cleanly at the end. Two checklists, depending on which side you're on.

Four permission mistakes that get expensive

One separate case worth a mention: when a client migrates domains, Change of Address requires Owner level on both properties and has its own rules that don't fit in this post.