Portal Authentication

The client portal uses magic link authentication. Clients do not need to create an account or remember a password. They simply enter their email and click a link to log in.

Magic Link Flow

1. The client navigates to the portal URL
2. They enter their email address
3. The system sends a one-time magic link to that email
4. The client clicks the link in their inbox
5. A session is established and the client is redirected to the dashboard

Sign-in code fallback

The sign-in email shows the same token as a copyable code beneath the button. Mail clients that break links (plain-text rendering, corporate link rewriting, aggressive scanners that consume one-time links) would otherwise dead-end the buyer.

The /portal/login page has a matching "Sign in with a code" field: pasting the code (or the entire mailed link, the token is extracted either way) redeems it through the same validation as a clicked link. It is subject to the same expiry and one-time-use rules.

Security

• One-time use: a link from the sign-in form can only be used once
• Expiration: magic links expire after a limited time window
• Email verification: the link implicitly verifies the client owns the email address
• Session duration: once authenticated, the session persists so clients do not need to re-authenticate on every page load

No Password Required

Magic links eliminate password-related friction:

• No password creation or complexity requirements
• No forgotten password recovery flows
• No credential storage risks on the client side

The client only needs access to their email inbox to authenticate.

Configuration confirmation links

Buyers who submit through the public configurator get a second kind of magic link, embedded in their confirmation email. It is long-lived and reusable so they can return to it weeks later; see Configurations & drawings.