Client Portal Administration

Setting Up Client Logins

The Client Portal uses a separate authentication system from your internal staff login. Clients authenticate via cookie-based sessions rather than JWT tokens, and their access is automatically scoped to their own client record -- they can never see another client's data.

To create client access, navigate to the client's record in XeroFlow and open the Portal Access section. Enter the contact's email address and send an invitation. The recipient confirms the secure link and enters the portal without setting a password. You can invite multiple contacts per client, each with individual permissions; the same contact can also receive clearly labelled access links for separate client organisations.

Configuring Permissions

Each client portal user has granular permissions that control exactly what they can see and do. Core controls include:

• canViewProjects

  Controls access to client-visible projects, status, tasks, timelines, and shared deliverables.

• canViewInvoices

  Allows the client user to view their invoices and billing history in the portal. When disabled, the Invoices section is hidden entirely from their navigation.

• canApproveWork

  Grants the ability to approve or request revisions on deliverables submitted for review. Without this permission, the user can view approval items but cannot take action on them.

• canAddComments

  Enables the user to leave comments on projects, approvals, and deliverables. This is useful for client contacts who need to provide feedback but should not have approval authority.

• canViewAnalytics

  Shows campaign performance, lead volume, outcome trends, and approved exports for the client account.

• canSubmitRequests

  Allows the contact to submit structured briefs, job requests, and support items from the portal.

Permissions are set per user, not per client, so you can give a marketing director full access while limiting a junior contact to view-only. Changes take effect immediately -- no logout required.

Managing Approval Workflows

The approval system lets you submit deliverables -- design mockups, ad creatives, copy documents, or any file -- to a client for review. When you create an approval request, you select the client, attach the deliverable files, and add a description of what needs to be reviewed.

The client sees the approval in their portal with a clear status: Pending, Approved, or Revision Requested. When a client requests revisions, they can add comments explaining what needs to change. Your team receives a notification, makes the updates, and resubmits. The full history of submissions, comments, and status changes is tracked, creating an auditable record of the approval process.

Customising the Portal Experience

The portal layout adapts based on permissions. If a client user does not have invoice access, the Invoices tab disappears from their sidebar entirely -- they never see it. The same applies to approvals and other permission-gated sections. This means each client contact sees a clean, relevant interface tailored to their role.

The portal can bring together CRM and leads, campaign analytics, measurement health, projects, briefs, requests, meetings, video reviews, shared assets, social workflows, approvals, and invoices. Only client-scoped records and enabled actions are returned, while notifications surface the updates that need attention.

Inviting Clients

The invitation flow is designed to be frictionless. When you send an invite, the client receives a branded email with a single-use activation link and opens the portal without credential setup. Invitations expire after 7 days but can be resent at any time.

You can track invitation status from the client record -- see whether an invite was sent, accepted, or is still pending. Returning clients enter their email on the portal login page and receive a link that expires after 15 minutes and works once. Session management uses secure httpOnly cookies, and client sessions remain separate from staff authentication.

Security and Data Isolation

Every portal API endpoint enforces data isolation at the query level. When a client user makes a request, the server automatically scopes all database queries to their clientId. There is no parameter the client can manipulate to access another organisation's data -- the scoping happens server-side based on the authenticated session.

Staff and client authentication systems are entirely separate. The global auth middleware skips all /portal routes, and portal middleware only applies to portal pages. This dual-auth architecture ensures that a compromised client session cannot escalate to staff-level access.