Building a multi-account manager for popular email marketing platforms

Australian marketing teams often manage separate client, brand, and product accounts across Mailchimp, Klaviyo, HubSpot, Brevo, and similar platforms. A multi-account manager creates one operational view of those accounts without merging subscriber lists, campaign data, billing details, or permissions. It is especially useful for agencies and in-house teams that would otherwise navigate dozens of dashboards.

The system should orchestrate authorised accounts through official APIs rather than automate sign-ins or bypass platform restrictions. Its purpose is to centralise administration, improve deliverability monitoring, and reduce repetitive work. That distinction keeps the project compliant with each provider’s terms while still delivering meaningful operational value.

A practical operating model

Start by defining an account registry that records the platform, external account identifier, client or brand, market, owner, status, and authentication reference. It becomes the source of truth for a normalised interface while the platform-specific adapters handle differences between APIs, object names, and pagination methods.

Sydney and Melbourne agencies commonly maintain separate workspaces for clients, while franchises may use one platform but require isolated audience segments. Australian teams often describe this work as “sorting out the client accounts”, reflecting its practical, unglamorous nature. Each registered account should have a clear purpose, responsible person, and status so that dormant workspaces do not become sources of accidental sends.

Security and tenant boundaries

Use OAuth wherever a platform supports it, and store refresh tokens in a managed secrets vault rather than a database or browser. Local development secrets should live in an environment vault, while production access should use short-lived credentials, encrypted backups, and audited key rotation. Plain-text passwords should never be stored.

Tenant separation must extend beyond the interface. API calls should be scoped to the selected account, cached records should include a tenant identifier, and background jobs should verify their destination before acting. Role-based access can give account managers permission to draft campaigns while administrators control authentication, integrations, suppression lists, and account status. Every material action should produce an immutable audit entry.

Core components and data flows

The application needs a control panel, account registry, campaign service, event processor, and reporting layer. A central queue can coordinate jobs such as audience synchronisation, event-triggered campaigns, draft approval, and deliverability checks. The account management workflow is relevant when preparing verified subscriber records for a controlled import.

The account and campaign layers should expose a common set of capabilities:

• Registering and labelling authorised platform accounts
• Switching between tenants without mixing their data
• Synchronising audience segments and attributes
• Creating drafts through platform-native templates
• Scheduling campaigns within approved sending windows
• Reporting engagement, failures, and account-level status

Each adapter should translate normalised commands into the platform’s own API format. Responses should map into consistent internal models, while rate limits, retry rules, and temporary failures remain visible in the job queue. This prevents one provider’s behaviour from becoming an accidental assumption across the entire system.

Operational records should support investigation and repeatable reporting:

• Recording API calls, responses, and correlation identifiers
• Tracking token expiry and permission changes
• Maintaining a history of edits to campaigns and audiences
• Capturing bounce, complaint, and suppression events
• Storing scheduled-job outcomes and retry decisions

Webhook processing should verify signatures, reject duplicate events, and place invalid records into a review queue rather than repeatedly retrying them. Synchronisation also needs an explicit conflict policy, especially when staff edit subscriber attributes in both the email platform and a CRM.

Deliverability and Australian requirements

Deliverability features should sit beside campaign management. DKIM, SPF, and DMARC status, domain alignment, bounce rates, complaint rates, and suppression lists should be visible per account. The manager can flag risks and schedule maintenance, but automated sending should still respect each platform’s limits and the client’s approved strategy.

Australia adds several practical constraints. Campaign clocks must account for AEST and AEDT, with regional teams in Perth and Brisbane often working on different schedules; an Australian audience may also overlap with New Zealand campaigns that follow a separate consent framework. Messages need locally appropriate sender details, pricing in Australian dollars where relevant, and clear business identification.

Commercial email must also align with the Spam Act 2003, including consent, accurate sender information, and an accessible unsubscribe mechanism. Subscriber records should retain their source, consent evidence, timestamp, and applicable market. Where personal information is handled, access, retention, and deletion processes should reflect Australian privacy expectations as well as the client’s obligations.

Testing, rollout, and daily operation

Begin with sandbox accounts or test audiences, then validate each adapter against documented API behaviour. Contract tests can compare the internal response model with live platform objects, while end-to-end tests should confirm that a test segment, draft, and event are handled correctly. Repeated events and expired tokens are particularly important failure cases to rehearse.

Roll the system out one platform and a small group of client accounts at a time. Monitor queue latency, API error rates, token refreshes, audience discrepancies, and campaign comparisons against each platform’s native reporting. A shadow mode can calculate intended sends without dispatching them, allowing agencies to verify automation before activation.

Daily operation should assign clear ownership for failed synchronisations, deliverability warnings, permission changes, and dormant accounts. Support staff need account-level logs that show what the system changed, when it changed it, and whether the platform accepted the action. This produces a multi-account manager that is easier to audit, safer to operate, and genuinely useful across a distributed Australian client portfolio.