Concorbit HelpAll guides →

Portal Setup

Portal Setup & Configuration

This guide covers how to enable the Client Portal, configure portal access for your contacts, set up authentication, and customize the portal experience.

Enabling the Portal

The portal is controlled at the tenant level. To enable it:

  1. Navigate to Settings in your concorbit dashboard.

  2. Find the Portal section.

  3. Enable the Portal Enabled setting.

When the portal is disabled, all portal routes return a 404 error and contacts cannot authenticate.

Portal Domain

The portal is served from your tenant's subdomain:

https://{your-slug}.concorbit.com/portal

Your slug is your tenant's unique identifier, set when your account was created. The portal login page is at /portal/login on your subdomain.

In production, the portal is served over HTTPS. In development environments, it may use HTTP.

Enabling Portal Access for Contacts

Portal access is controlled per-contact in the CRM:

Enabling Access for a Single Contact

  1. Navigate to CRM > Contacts.

  2. Open the contact's record.

  3. In the portal settings section, enable Portal Access.

  4. Optionally set a portal password for email/password login.

  5. Save the contact.

Once portal access is enabled, the contact can authenticate via magic link immediately. If you set a password, they can also use email/password login.

Bulk Enabling Portal Access

To enable portal access for multiple contacts:

  1. Navigate to CRM > Contacts.

  2. Select the contacts you want to enable.

  3. Use the bulk action to enable portal access.

Disabling Portal Access

To revoke a contact's portal access:

  1. Open the contact's record in the CRM.

  2. Disable Portal Access.

  3. Save the contact.

Active portal sessions for that contact will continue until they expire naturally, but the contact will not be able to start new sessions. To immediately terminate access, disable portal access and clear any active sessions from the admin interface.

Portal Authentication

The portal supports two authentication methods. Both are available simultaneously, contacts can use whichever method they prefer.

Email and Password Login

For contacts who prefer traditional authentication:

  1. Set a portal password on the contact's CRM record.

  2. The contact navigates to your portal login page.

  3. They enter their email address and password.

  4. On successful authentication, they are redirected to the portal dashboard.

Passwords are hashed using bcrypt before storage. Failed login attempts return a generic error message to prevent email enumeration.

For passwordless authentication:

  1. The contact navigates to your portal login page.

  2. They enter their email address and click "Send Magic Link".

  3. concorbit sends an email containing a one-time login URL.

  4. The contact clicks the link in the email.

  5. The link is verified and a portal session is created.

  6. The contact is redirected to the portal dashboard.

Magic link details:

  • Links are valid for 30 minutes from creation.

  • Each link can only be used once. After use, it is marked as consumed.

  • The link token is hashed before storage (SHA-256) to prevent database leaks from exposing valid tokens.

  • A row-level lock is used during verification to prevent race conditions with concurrent requests.

  • The login page always shows a success message after submitting an email, regardless of whether the email exists. This prevents email enumeration attacks.

Magic links are sent via your tenant's configured email provider (using the SMTP provider with failover) and appear in your email logs alongside campaign mail.

Session Management

Portal sessions are stored in a dedicated portal_sessions table, separate from admin sessions:

  • Sessions record the contact ID, tenant ID, IP address, and user agent.

  • Session lifetime follows the application session configuration (default: 120 minutes).

  • The session is stored in a secure, HTTP-only cookie named portal_session.

  • The cookie uses the SameSite=Lax policy and is marked secure in production.

Logging Out

Portal users can log out via the portal interface. Logging out:

  1. Deletes the portal session from the database.

  2. Clears the portal session cookie.

  3. Redirects to the portal login page.

Custom Branding

The portal displays your tenant's branding to create a seamless client experience:

Branding Elements

ElementWhere it appears
Company nameLogin page, portal header, shared secret pages, message sender name.
Accent colorButtons, links, active states, and interactive elements throughout the portal.
LogoPortal header and login page.

Configuring Branding

Branding is configured in your tenant's settings, not in the portal settings specifically:

  1. Navigate to Settings > Branding (or the equivalent branding section).

  2. Set your company name, upload your logo, and choose an accent color.

  3. Save. Changes take effect immediately across the portal.

The portal uses the TenantBrand service to resolve branding, ensuring consistency between your admin interface, portal, and outgoing emails.

Portal Permissions and Feature Toggles

Messaging

Portal messaging can be enabled or disabled at the tenant level:

  • Setting: portal_messages_enabled

  • Default: Enabled (true).

  • When disabled, the Messages navigation item is hidden from the portal, and all messaging endpoints return 404.

Online Payments

Online payment capabilities in the portal depend on your Stripe integration:

  • If your tenant has a Stripe integration configured (canAcceptPayments() returns true), contacts can pay invoices online and manage payment methods.

  • If no Stripe integration is configured, payment-related features are hidden or show a "not available" message.

Vault Access

Vault access in the portal is available whenever:

  • The portal is enabled.

  • The contact has portal access.

  • Secrets have been shared with the contact, or company vault folders exist.

There is no separate toggle for portal vault access.

Docs Access

The Docs section in the portal shows all books with portal or public visibility. There is no separate toggle, any book you set to portal or public visibility automatically appears in the portal Docs section.

Portal Security

Email Enumeration Protection

The portal login and magic link endpoints are designed to prevent email enumeration:

  • Password login returns a generic "credentials do not match" error regardless of whether the email exists.

  • Magic link sending always returns a success message, even if no contact exists with that email.

Session Isolation

Portal sessions are completely isolated from admin sessions:

  • Different cookie names (portal_session vs. the admin session cookie).

  • Different database tables (portal_sessions vs. the admin sessions table).

  • A portal user being logged in does not grant any admin access.

Contact Verification

All portal data endpoints verify that the authenticated contact belongs to the current tenant. Cross-tenant access is not possible.

Rate Limiting

Standard rate limiting applies to portal authentication endpoints to prevent brute-force attacks.

Troubleshooting

"These credentials do not match our records"

  • Verify the contact has portal_enabled set to true.

  • Verify the contact has a portal password set (for password login).

  • Check that the email address matches exactly (case-insensitive).

  • Check your email logs for delivery status.

  • Verify the contact's email address is correct.

  • Ensure your SMTP provider is configured and operational.

Contact cannot see invoices/files/subscriptions

  • Verify the items are linked to the contact's record or their company's record.

  • For invoices, verify they are not in draft status (drafts are hidden from the portal).

  • For files, verify the portal_shared flag is set to true.

Portal returns 404

  • Verify the portal_enabled tenant setting is true.

  • Verify you are accessing the correct subdomain.