Portal login, registration and password reset
Use code-backed email/password login, client registration and forgotten-password endpoints.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Log in a client through the API
POST the master token plus valid email/password to /portal_api/login; successful authentication returns a short-lived client session.
Use POST for portal login
Other methods are rejected.
Complete login email
Use the client contact email.
Complete login password
Use the client portal password; do not log it.
Set login session expires_in
Optional 60–900 seconds, default 600.
Resolve failed portal login
Check active contact, password, client account and master profile controls.
Register a client account through the API
POST supported identity/company/contact/password fields to /portal_api/register.
Understand registration validation
The production model validates required data, email/account conflicts and password/consent conditions exposed by its input flow.
Understand registration result
Successful registration can create/authenticate the client identity and return session context.
Request a client password reset
POST the client email to /portal_api/forgot_password.
Understand privacy-safe reset behaviour
Use the returned success/message without exposing whether an unrelated account exists.
Understand CSRF exclusions
Only server-to-server session, login, registration, forgot-password and Scroll document-upload endpoints are excluded.
Understand retired client endpoint
The legacy arbitrary client-ID endpoint is retired and instructs integrations to use session/me.
Understand retired contact endpoint
The legacy arbitrary contact-ID endpoint is retired and instructs integrations to use session/me.