Configurable Magic Links: Client Logins That Fit How You Work

Asking a client to create and remember yet another password is friction you do not need. It leads to reset emails, shared credentials, and abandoned logins. Portalize uses passwordless magic links instead: a client enters their email, gets a secure one-time link, and lands straight in their portal — no password to create, forget, or leak.

The default is a short-lived, single-use link, which is the safest choice. But real teams work in different ways, so magic links are now configurable per portal.

Control how long a link stays valid

Some clients open your email in seconds; others get to it the next morning. Under the Client Login settings you can set how long a login link works after it is sent, choosing from:

• 15 minutes (the default — tightest security)
• 1 hour
• 4 hours
• 24 hours
• 7 days
• 30 days

Shorter windows are safer; longer windows are more forgiving for busy clients. Pick the shortest one that fits how your clients actually behave.

Shared, reusable links for whole teams

Sometimes one login should serve a group — everyone at a client company, a shift of people on a factory floor, or a shared inbox. Turn on reusable links and a single link can be used by multiple people until it expires, instead of being consumed on first use. It is the difference between provisioning one link for a team and chasing down individual invites.

One thing to know: everyone who uses a shared link signs in as the client the link was issued for. It is a convenience feature, not separate accounts — so reach for it when a team genuinely shares one view of the data.

Revoke access instantly

If a link leaks or a team member leaves, you should not have to wait for it to expire. A single Revoke active links action immediately invalidates every login link already sent for that portal. Clients simply request a fresh one the next time they need in.

Matching security to the portal

The right settings depend on the work. For a portal with invoices and contracts, keep the default 15-minute single-use links. For a low-sensitivity dashboard a whole team checks daily, a longer-lived reusable link may be worth the convenience. Configurable magic links let you make that call per portal instead of accepting one rigid policy for every client.

As a rule of thumb: prefer the shortest validity that works, keep reusable links off unless a team truly shares access, and revoke the moment something feels off.