How to Give Your Remote Bookkeeper Secure Access to QuickBooks Online

By OptiVal Editorial Desk

You just hired a remote bookkeeper and they need to get into your QuickBooks Online. The fastest route is obvious: send them your username and password. It is also the worst thing you can do. The moment someone else logs in as you, you lose the audit trail, you lose the ability to revoke access cleanly, and if anything ever goes sideways, you cannot tell whose keystrokes did what. Here is how to give your remote bookkeeper access to QuickBooks Online the right way, in about fifteen minutes.

The mistake most owners make

Sharing your own login feels harmless because you trust your bookkeeper. But your admin login can do everything: change banking connections, edit closed periods, invite and remove other users, and see payroll details. QBO’s audit log will record every change as coming from you, which makes troubleshooting nearly impossible. And when the working relationship ends, you cannot just disable their access. You have to change your own password, update every saved session, and hope nothing was left connected.

The correct setup gives each person their own identity, the smallest set of permissions that lets them do the job, and a clean off switch. Three systems are involved: QuickBooks Online itself, your bank connections, and CRA access. Each one has its own proper way to add a second person.

Give your remote bookkeeper access to QuickBooks Online through the accountant invite

The best seat for a remote bookkeeper is the free accountant user. Intuit lets you invite up to two accountant users (three on the Advanced plan) at no cost, and they do not count toward your plan’s paid user limit. The bookkeeper gets full bookkeeping privileges, including accountant-only tools like undoing a full reconciliation and reclassifying transactions in bulk, without touching one of your paid seats.

To invite them: go to Settings, then Manage users, then the Accountants tab, and click Invite accountant. Enter their email address. They will get an invitation they accept with their own Intuit login. One practical tip: invite a real person, not a shared inbox. If two people ever need access from the bookkeeping firm, the firm can add team members on its side through QuickBooks Online Accountant once the first person is connected.

QBO user roles, decoded

If your remote bookkeeper is more of an internal admin assistant than an accounting professional, you might use a standard role instead of an accountant invite. Here is what each role actually means:

• Primary admin: the account owner. Full access to everything, including billing. Only one person should ever hold this. That is you.
• Company admin: nearly the same as primary admin but cannot change the subscription billing. Fine for a co-owner or office manager you trust completely, not for a bookkeeper.
• Standard, all access: can use everything except subscription billing and user management. The right fit for a remote bookkeeper if you are not using the accountant invite.
• Limited roles (customers and suppliers, and similar): narrow permissions for staff who only handle invoices or bills. Too narrow for a bookkeeper doing full-cycle work.
• Reports only and Time tracking only: free roles that do not count toward your user limit. Useful for an owner who just wants to view reports, or for staff entering time.
• Custom roles: available on the Advanced plan. Let you build granular permissions, for example letting a bookkeeper reconcile and categorize but not run payroll.

Start with the smallest role that works and widen it only when the bookkeeper can name a task they cannot complete. That is the least-privilege habit in practice.

Bank connections: let the owner connect the accounts

Your bookkeeper does not need your online banking password, and they should never have it. In QuickBooks Online, bank feeds are connected through the owner’s banking credentials, and once the feed is live, the bookkeeper works with the imported transactions. The connection uses the bank’s own sign-in page, and you stay the person on record for it.

The workflow is simple. You connect each account once, turn on the feeds, and the bookkeeper categorizes, matches, and reconciles. If your bank uses multi-factor authentication, expect it to ask for a fresh code periodically. Handle those yourself rather than sharing the code stream; it takes thirty seconds and keeps your banking credentials where they belong.

This matters for liability as well as hygiene. Most business banking agreements require you to keep credentials confidential. Handing them to a bookkeeper can give the bank an excuse to deny a fraud claim if something ever goes wrong.

CRA access: authorize your bookkeeper as a representative

If your bookkeeper files or checks HST/GST, payroll, or corporate tax items, they need CRA access too. You grant this in CRA My Business Account, and you have two decisions to make: the access level and the scope.

• Level 1 (view): the representative can view account information but not change anything. Right for a bookkeeper who checks balances and confirms filings.
• Level 2 (update and view): the representative can also make changes, file returns, and deal with the CRA on your behalf. Right for a bookkeeper who actually files your HST/GST and payroll remittances.

The process: sign in to My Business Account, go to Profile, then Authorized representatives, then Manage authorized representatives, and choose Authorize a representative. Enter their RepID, GroupID, or business number, pick the access level, decide whether to set an expiry date, and confirm. Access takes effect immediately. If the bookkeeper sends you an authorization request from their Represent a Client portal instead, review and approve it within ten business days or it is cancelled and they have to start over.

Keep Level 2 for people who genuinely file. A bookkeeper who only reconciles books can usually do their whole job at Level 1.

Your fifteen-minute secure setup checklist

1. Invite your bookkeeper as a free accountant user through Settings, Manage users, Accountants tab. Use their personal email, never a shared inbox.
2. Confirm they appear with their own login. Ask them to sign in once while you watch the user list update.
3. Connect your own bank accounts to QBO yourself. Do not share your banking password.
4. Authorize CRA access at the right level (Level 1 to view, Level 2 to file) through My Business Account.
5. Turn on multi-factor authentication on every account involved, QBO included.
6. Write down who has access where. One line per system is enough, and it makes offboarding a five-minute job later.

Done right, your remote bookkeeper has everything they need and nothing they do not. If the relationship ever ends, you revoke their invite, remove their CRA authorization, and your own logins never change. That is the whole point: access that is granted deliberately can be withdrawn cleanly.

Getting the setup right is the easy part. The harder part is finding a remote bookkeeper worth giving access to, then managing them well. We run remote staffing for Canadian businesses: vetted remote bookkeepers, set up with proper access controls from day one, led by qualified professionals with more than 75 years of combined experience. Bookkeeping plans start at $199/month. Book a free consultation and we will map out what your books actually need.