Portal Invitations

Portal Invitations

What Is the Client Portal?

The client portal gives your contacts a secure login to view their documents, invoices, payment history, and sign documents. Instead of emailing individual links, contacts can log in and see everything assigned to them in one place.

Requirements

The portal feature must be enabled on your plan. Contacts must have an email address to receive an invitation.

Sending an Invitation

From a contact’s detail page, find the Portal Access section in the sidebar and click Invite to Portal. You can optionally require the contact to set up two-factor authentication.

When you send the invitation:

1. A secure 64-character random token is generated.
2. The plaintext token is sent to the contact via email as an activation link.
3. A SHA-256 hash of the token is stored in the database (the plaintext token is never stored).
4. A user account is created for the contact with their email address (pre-verified, with a temporary random password).
5. A portal membership is created with pending status.

Token Expiration

Invitation links expire after 48 hours for security. If a contact tries to activate after 48 hours, they will see an expiration message and you will need to resend the invitation.

Activation Process

When the contact clicks the activation link:

1. The token is validated (checked against the stored hash and the 48-hour window).
2. The contact sets a password (at least 8 characters with uppercase, lowercase, a number, and a symbol; must be confirmed).
3. Their portal membership status changes from pending to active.
4. The invitation token is cleared from the database.
5. The contact’s portal_activated_at timestamp is recorded.

Resending Invitations

If an invitation expires or wasn’t received, click Resend Invitation on the contact’s detail page. This generates a new token (invalidating the old one) and sends a fresh email.

Revoking Access

Click Revoke Portal Access on the contact’s detail page. This immediately:

• Deletes the portal membership (the contact’s user account is kept, but they can no longer log into the portal)
• Resets all portal fields: portal_enabled, invitation token, invitation date, and activation date

You can re-invite the contact later if needed.

Portal Status Indicators

The contact detail page shows the current portal status:

• Not Invited — no invitation has been sent
• Invitation Pending — invitation sent, waiting for activation (shows when the invitation was sent)
• Active — contact has activated their portal account (shows activation date, last login date, and total login count)