A testimonial social media post is the cheapest place a collected testimonial goes to work, and the easiest place to get the permission question wrong. This page is the practical shape of one, and the two things that have to be true before you publish: the customer agreed to this use, and any material connection between you is disclosed.
The crop
Quote, name, role, company, and nothing else. A screenshot of an email is more convincing than a designed card, provided the sender's address is not in it. Keep it legible on a phone at a glance, because that is the only way anybody will see it, and put the customer's name in text rather than only in the image.
The caption
Say what the work was, in one line, in your own voice. The quote is the customer's; the context is yours, and mixing them is what makes a post read as invented. Say what the job was, when it happened and what the customer's business does, in one line, and let the quote do the rest of the work.
The permission
'Website and marketing' covers social if you said so when you asked. If the ask only mentioned the website, ask again. And if the customer received anything for the words, the connection has to be disclosed clearly in the post itself.
Questions people ask about testimonial social media post
Can I post a screenshot of a message they sent me?
Ask first. A private message is not a testimonial you were given permission to publish.
Do I need to disclose an incentive on social?
Yes, clearly and conspicuously, in the post rather than in a bio or behind a link.
How often can I post the same testimonial?
As often as you like; you have the permission. Vary the customer rather than the design.