Mastodon Business Account: How Brands and Teams Manage It Without Sharing Passwords

Can a team run a business account on Mastodon? #

Not through a special account type, as far as Mastodon's own pages show (read 3 October 2026). They describe ordinary accounts that live on a server, plus roles for the people who run a server. For organisations, the official route is a server of their own: joinmastodon.org offers managed hosting for institutions, where each account lives under the organisation's domain and the team can be invited and given roles.

Three ways to set it up #

joinmastodon.org describes the all-in-one service as tailored for large organisations, and the single-service option as designed for organisations that want to stay in control and already have, or want to build, internal resources. A smaller team can start with an account on an existing server, which is the first row.

Roles on a server you run #

These roles are for the people who run the server. They are not a way to post as someone else's account. The roles page explains how to create and edit roles but not how to assign one, so follow your server's admin interface and documentation.

Verification, handles and automated accounts #

Verification on Mastodon is done with links. joinmastodon.org says your website needs a link back to your Mastodon profile that carries a rel="me" attribute; you then add the site's address to one of your four profile fields and save. The documentation adds that the address must start with HTTPS, and that a checkmark appears when Mastodon confirms you own the linked site. The Help Centre's etiquette guide recommends this for anyone running a website, so people can tell it is really you or your organisation.

On a server under your own domain, handles carry that domain, as in the hosting page's example @name@brandname.social. If an account posts automatically, switch on the bot flag in the profile settings: it adds a bot icon so others know the profile may perform automated actions or may not be monitored by a human.

Checklist: access, two-factor authentication and off-boarding #

1. Give each person their own account where you can. On a server the organisation runs, staff get their own accounts and roles.
2. Keep the account's e-mail address with the organisation. Password resets are sent there, so use a mailbox the organisation controls and name an owner for it.
3. Turn on two-factor authentication in the account settings. Mastodon 3.2's release post says any TOTP app works and no phone number is needed.
4. Do not pass one password round a team. The Help Centre says only the account holder can delete an account, that deleting needs the password, and that a deleted account cannot be restored, so anyone who has the password could do it. If a brand account must be shared, name one holder and let others send their drafts to them.
5. When someone leaves, close the door. In the account settings, change the e-mail address if they had it, set a new password, and revoke active sessions and authorised apps.
6. On a server you run, review roles. Use your server's admin tools to change or remove the roles of anyone who has left.
7. Write down who owns what. The account, its mailbox, the two-factor device and the verified website each need a named owner.

When the person who set it up has gone #

If you still control the mailbox, open the login page of the server that hosts the account and choose Forgot your password?. The Help Centre says the reset link is only sent when you start on that server's login page. If you do not control the mailbox, or the two-factor device is gone, contact the server's administrators: the documentation lists commands that update an account's e-mail address, reset a password and remove additional factors. For mastodon.social and mastodon.online, the Help Centre calls itself the quickest way to find support.

Where ADSSPEED fits #

For teams, ADSSPEED is a desktop app for Windows and macOS that manages many browser profiles. Each profile has its own cookies, local data and browser settings, so the accounts a team is authorised to manage can stay signed in side by side without signing each other out. Profiles can be opened, stopped and organised in bulk, and a proxy can be set per profile and assigned to many profiles in bulk. Profile data is kept on your own computer. ADSSPEED is not affiliated with Mastodon and does not change who may use an account. See how to install ADSSPEED on Windows.