Single-use email links give clients a separate, secure login experience that is completely scoped to their data and permissions.
The client portal uses an entirely separate authentication system from the staff dashboard. Clients request a single-use email link, confirm the browser, and receive an httpOnly client session cookie. Every API request remains scoped to that user's client ID at the server layer, not just hidden in the interface.
Invite clients to the portal by email. The branded invitation activates access directly after the recipient confirms it, with no password setup. The invitation specifies invoice, approval, comment, analytics, CRM, and other permissions so each contact starts with the correct access.
Sign-in links expire after 15 minutes, are stored only as SHA-256 digests, and can be consumed once. The credential stays in the browser URL fragment rather than request logs, and an explicit confirmation prevents ordinary email-security scanners from using it before the client does.
Each client user is assigned a set of permissions: canViewInvoices, canApproveWork, canAddComments, and more. Permissions are evaluated on every API request and used to conditionally render navigation items and page content. A client's marketing manager might have full access, while their CEO only sees invoices and high-level project status — same client account, different permission sets.
The client portal uses a clean, dedicated layout separate from the agency dashboard. Clients see only the sections relevant to them — CRM, leads, campaign analytics, measurement, meetings, briefs, social workflows, projects, approvals, shared files, invoices, and notifications. No internal tools, no other client data, no agency operations. The experience is professional and purpose-built for external stakeholders.