i'd use TBA and give them their token to access your account or alternatively they can use a login/pass that has access to the account as well