How to Give a Team or a Client Access to GitHub Without Sharing a Login

Can a team use GitHub without sharing one login? #

Yes. GitHub's model gives each person their own login and puts the shared work in an organization. According to GitHub Docs (read 3 October 2026), an organization is a shared account where many people collaborate across many projects, but you cannot sign in to an organization: each person signs in to their own personal account. The Terms of Service back this up: each login is for one person, and sharing a single login among several people is not allowed.

GitHub also says you cannot create personal accounts on behalf of another person, so each teammate or client creates their own and you invite them. Enterprises that use Enterprise Managed Users work differently: members are provisioned and managed through the company's identity provider.

Which roles can you give people? #

Organization owners assign roles to individuals and teams. These are the organization-level roles GitHub describes:

Repository access has its own ladder. GitHub recommends Read for non-code contributors who want to view or discuss the project, Triage for people who manage issues, discussions and pull requests without write access, Write for contributors who push, Maintain for project managers who need no sensitive or destructive actions, and Admin for people who need full access. Custom repository roles need GitHub Enterprise Cloud.

How do you set up access for a client or a contractor? #

GitHub's page on creating an organization for a client lists these steps among others:

1. From your own personal account, create the organization.
2. Open the People tab, click Invite member, search for the client's username and select Owner. You cannot go on until the client accepts.
3. When the client is listed as an owner, use Manage, then Remove from organization next to your own name.
4. If you still need a role, the page suggests asking the client to add you as a billing manager.

For a contractor who should touch only some repositories, use an outside collaborator instead. GitHub says outside collaborators cannot be added to teams, and that if the organization requires two-factor authentication they must enable it before accepting. Invitations by username or email expire after seven days, and an invitation by email can only be accepted if it matches a verified email address on the invitee's account.

How do you protect shared access: 2FA, SSO and bots? #

• Require 2FA. Owners can make it mandatory for members, outside collaborators and billing managers. Members and billing managers who have not enabled it are locked out of the organization's resources until they do. Outside collaborators who have not are removed and lose access, and GitHub says you can reinstate those collaborators within three months if they enable 2FA. A sole owner cannot turn off 2FA on their own account without also turning off the requirement.
• Use SSO where you have it. GitHub's SSO page (in the Enterprise Cloud edition of its docs) says members are redirected to the organization's identity provider, must re-authenticate periodically (24 hours unless the provider says otherwise), and must authorize any personal access token or SSH key before using it with the organization.
• Give automation its own identity. The Terms allow machine accounts, and GitHub's deploy-keys page lists deploy keys (access to a single repository), GitHub App installation tokens and machine users as options. For a shared bot account that requires 2FA, GitHub suggests a mailing list of account owners as the verified email, the authenticator secret kept in the organization's password manager, and password resets instead of a stored password.
• Treat tokens like passwords. GitHub says personal access tokens are tied to the user who made them and become inactive if that user loses access to the resource.

How do you off-board someone? #

1. In the organization, open People, select the person, open the selected-members menu and choose Remove from organization.
2. Expect these effects, per GitHub: private forks of the organization's private repositories stop being accessible to the person, though copies already on their computer remain; their membership data is saved for three months; and under volume license billing the paid license count does not downgrade by itself.
3. For an outside collaborator, use Outside collaborators in the People sidebar, then Remove from all repositories. GitHub notes that you remain responsible for making sure people who lost access delete confidential material.
4. With SAML single sign-on, open the member's SAML identity linked page to revoke the linked identity or an active session. Revoking a credential cancels only its SAML authorization; the token or key itself stays.
5. Check ownership before an owner leaves: owners can change other people's roles but not their own.

What if something goes wrong? #

• The only owner is unreachable. GitHub says the organization's projects can become inaccessible, so keep at least two owners.
• An invitation was never accepted. It expires after seven days; the invitation page has a section on retrying or cancelling expired invitations.
• Someone returns after leaving. Within three months you can reinstate their role, private forks, team memberships and permissions, provided a license is free on a paid per-user plan.
• Someone asks for your password. Do not hand it over. Invite them with their own account instead; the rules guide covers what GitHub's Terms and impersonation policy say about shared logins and borrowed credentials.

Where ADSSPEED fits #

ADSSPEED does not replace organization roles, and it does not change what GitHub allows. It is a desktop app for Windows and macOS that manages many browser profiles. Each profile keeps its own cookies, local data and browser settings, so a person who works across several accounts they own or are authorised to manage, such as a personal account and a work account, can keep each signed in side by side. Profiles can be opened, stopped and organised in bulk. See also the profiles guide. ADSSPEED is not affiliated with GitHub.