During the first onboarding/kickoff call, how do I actually get access to platforms like Google Sheets or Drive? Do I need the client's private credentials?

It depends on what you actually need. In some cases you need to pretend to be the client — for example if you're sending emails as them, from their domain, you need their Gmail credentials (or API creds), full stop. You'll need their username and password, or at least a service account with equivalent access, and in that case you really do need to be handed their credentials. But a lot of the time you don't need to impersonate them at all — you only need Google Workspace access. If all you need is something like Sheets or Drive, have the client create you a new account on their own domain (e.g. yourname@theirdomain.com) so you have your own login rather than theirs. Then, when you create an asset — a Sheet, a Drive file, whatever — Google Workspace lets you share it domain-wide instead of restricting it to just you: on the file's share settings, instead of "anyone with the link," you add the domain itself as a group, set the access level (viewer/commenter/writer), and now everyone at that domain — including the client — automatically has access to anything you create, no individual re-sharing needed. Most integration platforms' Google modules (Sheets, Drive, etc.) support creating that kind of share link directly. So the short version: only ask for their actual Gmail/email credentials when you genuinely need to send or receive email as them, or need a webhook listening on their inbox — for everything else, a domain account plus domain-wide sharing gets the job done without ever touching their real login. And yes, Google's 2FA is genuinely one of the more annoying parts of this to deal with.