Client Portal API profiles and one-time tokens
Create, secure, review and revoke one token per external portal with sections, domain, server IP and rate limits.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Open the Client Portal API profile form
Use the visible Main Flow card.
Complete API name
Required administrator label, for example an external client portal name.
Complete Profile key
Enter a short internal identifier such as abc_estate_portal.
Complete Allowed domain
Record the external portal domain for reference/audit.
Complete Allowed server IPs
Optionally restrict calls to backend server IP addresses.
Set Rate limit per minute
Choose 10–1000; the visible default is 120.
Select allowed portal sections
Only checked sections are encoded into the portal profile.
Create the Portal API
Submit the form after selecting security and data scope.
Copy the one-time token
The newly generated private token is shown once in flash data and cannot be displayed again.
Store the token server-side
Never expose the master token in browser JavaScript.
Review portal profiles
The page lists existing portal profiles and enabled modules.
Revoke a portal profile
Use Revoke; status becomes revoked and authentication stops.
Understand usage metadata
Profile records can retain last-used information when authenticated.
Understand one-way portal token storage
The token is stored as a SHA-256 hash rather than recoverable plaintext.
Review detected enabled modules
Use the enabled-module display to understand available automatic data adapters.
Allow portal section: Client profile
Core customer/account profile.
Allow portal section: Contacts
Active contacts related to the customer.
Allow portal section: Invoices
Customer invoices permitted by portal rules.
Allow portal section: Invoice payments
Payments related to the customer invoices.
Allow portal section: Estimates
Customer estimates.
Allow portal section: Proposals
Customer proposals.
Allow portal section: Projects
Customer projects.
Allow portal section: Tickets
Customer support tickets.
Allow portal section: Contracts
Customer contracts.
Allow portal section: Customer files
Authorised customer files.
Allow portal section: Subscriptions
Customer subscriptions.
Allow portal section: Automatic enabled module data
Data from detected supported modules.