What it is
The Client Portal is a private area that lives on a business’s own website — not a separate service with its own login screen, its own branding, and its own monthly bill. Each client signs in and sees exactly one thing: their own work. Where their project stands, what has happened lately, what is waiting on them, and their invoices. No app to install, no password to choose or forget, no client data scattered across another company’s servers.
Exactly how it works
I built it to be fast, owned, and close to maintenance-free. Here is the whole system, end to end.
Signing in — secure, without passwords
The sign-in page above is the whole front door: one email field, one button. A client types the address their invoices are sent to. If it matches a contact in the connected bookkeeping, they are emailed a single-use sign-in link — the same “magic link” method used by apps like Slack and Notion. The link is valid for 15 minutes, and clicking it signs them in for a day through a signed, http-only cookie.
This is the part I am most pleased with, because removing passwords made it safer, not weaker. There is no password anywhere in the system to reuse, phish, guess, or leak in someone else’s breach — and no password for the business to store or reset. The sign-in tokens are cryptographically signed, so a link cannot be forged or edited. And an unrecognised email address receives exactly the same “your link is on its way” response as a known one, so nobody can use the login page to work out who a business’s clients are.
For the client it is one less password to keep. For the business it is one less thing that can go wrong.
No database — on purpose
The bookkeeping stays the single source of truth for clients and billing; the portal stores none of it. Project status lives as plain Markdown files in the site’s own repository. Nothing is duplicated, so nothing can drift out of sync — and adding a project for a client is a matter of dropping in a Markdown file with their email address and their project’s phases.
Built to be safe
Every portal route is guarded centrally, and each request is scoped to the signed-in contact, so one client can never see another client’s projects or invoices. The portal pages are kept out of search engines entirely, and form submissions are origin-checked.
Inside the portal
Past that sign-in link, everything is deliberately quiet and plain. A client is not there to explore software — they are there to answer a question and get on with their day. Here is what they find.
The dashboard
The first screen answers “how do we stand?” before anyone has to click. Three figures sit across the top — outstanding balance, open invoices, active projects — followed by a card for each of their projects, and their most recent invoices underneath. Every number is fetched live as the page loads, so nothing on it can be out of date.
A project card carries its own headline: the project’s name, a status badge reading Design or Edit or Completed, and — when something is needed from the client — a small blue marker saying “2 waiting on you”. At a glance, a client knows whether the work is sitting with them or with the business.
A project page
Opening a project shows everything about it on one page:
- a phase tracker across the top, drawn as steps with the current one lit — Proposal → Design → Development → Review → Live for a website, or Briefing → Shoot → Edit → Review → Delivery for a film;
- a “waiting on you” checklist naming exactly what the project needs — the final text, the logo files, a sign-off — with delivered items ticked off, so the portal does the chasing, neutrally;
- a dated update timeline that accumulates what happened — design approved, staging live, first cut assembled — so the history stays in one place instead of sinking into an inbox;
- a change-request form that turns “could we tweak this?” into a proper ticket in the owner’s inbox, with the client and project already attached;
- and any quick links the project needs — a staging URL, a shared drive, a design file.
The invoices
The invoice list is the part people picture most easily, because it looks like the invoice list you would want. Each row shows the invoice number, what it was for, the date and due date, and the amount — with a coloured badge reading Open, Paid, or Late so status is obvious without reading a word.
On the right of each row sit two buttons: Pay this invoice, which opens the payment page from the bookkeeping, and a PDF button that downloads the official invoice document. That PDF is the real one from the accounting system, not a copy the portal generated — and it is passed through the site itself, so the bookkeeping access token never reaches the browser.
It is built against Moneybird, and because that connection sits in a single, self-contained module, the portal can be connected to other bookkeeping software through their APIs in the same way.
What it adapts to — and who it is for
The portal is not tied to one kind of business. The phases, the wording, and the checklist items all follow how a business works. A web project might run Proposal → Design → Development → Review → Live. A photo and video studio’s job runs Briefing → Shoot → Edit → Review → Delivery. Same portal, different worlds.
That is what makes it fit agencies, studios, architects, photographers, accountants, and consultants — anyone whose clients keep asking the same three reasonable questions: where are we, is anything happening, and do you need something from me? The portal answers all three around the clock, so nobody has to ask.
Why I built this, and why I built the members area
I am interested in this kind of solution on an Astro website — for the businesses and clubs and other organisations that need one. A business needs a client portal. A club needs a members area. It is interesting how it works, and it has to be safe.
So I built both, and they divide the same question between them. This one gives each person their own — one client’s projects and one client’s invoices, and the next client signing in sees a different set of pages. The members area gives every member the same: one set of reserved pages that all of them read, with nobody having records of their own. What a website needs depends on which of those two its people are signing in for.
Each has a post as well as a page here: the client portal and the members area.
I built them on this website to make them work and to test them. Building for yourself is the best way, because you can test it all the time — on the site you use every day, where you would notice the morning it broke.
The Client Portal is one of three projects that grew out of Hans Martens Dev — alongside Astro Rocket and the Members Area.