Client portal
The client portal is a website your clients sign in to. It shows them their invoices and lets them pay, approve quotes and other work, raise and follow tickets, ask you to set up or remove a member of staff, see their devices and reports, and connect to their own computers when you allow it. It carries your branding, not Outpost’s. This page explains how the portal works and what you decide for each client.
There is a separate guide for the people at your clients who use the portal, which you can send them: Using the client portal.
How it works
Section titled “How it works”The portal is part of your Depot, so it needs nothing installed.
- Address. The portal is at
https://<your-address>/portal, where<your-address>is the address you sign in to the console at. You can serve it on your own domain instead, for every client or for one. See Serve the portal on your own domain. - Off until you turn it on. The portal is off for every client until you turn it on for that client. Portal users cost nothing and have no limit.
- Separate from the console. A portal account can never sign in to the console, and a console account cannot sign in to the portal. Portal roles hold portal permissions only, so nothing you grant in the portal reaches your console.
- One account, several organizations. A person can be a member of more than one of your clients, for example a bookkeeper who works for two. They sign in once and switch between organizations. What they can do is set separately in each.
- Access checked on every request. When you suspend or offboard a portal user, the next thing they do in the portal is refused, on every Depot server, and their remote sessions end.
Signing in
Section titled “Signing in”Every portal user signs in with a password and a second factor, a passkey, or single sign-on:
- Password and a second factor. A second factor is required for everyone. After their first sign-in, a user sets up a passkey or an authenticator app before they can do anything else, and saves recovery codes.
- Passkeys. A user can sign in with a passkey alone.
- Single sign-on. For clients on Microsoft Entra ID, Google Workspace, or Okta, people sign in with their work account. See Set up single sign-on and directory sync.
Single sign-on never creates a portal user. Only people you, or the client’s owners, have invited can sign in.
Pages that handle money, people, remote access, and the account’s own sign-in settings ask the user to confirm who they are again after 15 minutes without activity, as PCI DSS 8.2.8 requires. Sessions also end after a set time idle and a set length. See Portal defaults.
What clients can do
Section titled “What clients can do”What each portal user sees depends on their roles. The portal uses your client’s words, not yours: Devices rather than endpoints, Activity log rather than audit log.
| Portal page | What it does | Documented in |
|---|---|---|
| Billing, Invoices, Next bill, Payments | Invoices, paying, receipts, and an estimate of the next bill | Client payments |
| Payment methods, Autopay | Saved cards and bank accounts, and automatic payment | Set up autopay for a client |
| Approvals, Quotes, Projects | One inbox for everything waiting on the client’s decision, quote signing, and milestone sign-off | Ask a client to approve something |
| Tickets | Raise tickets, reply, and attach files | Service desk |
| Starters and leavers | Ask you to set up or remove a member of staff | Handle starter and leaver requests |
| Devices, Reports | The client’s devices with warranty and age, and their reports, also by email on a schedule | Using the client portal |
| Remote access | Connect to their own computers, within limits you set | Let clients use remote access |
| People, Roles, Groups | Client owners manage their own people, within limits you set | Set portal roles, groups, and the permission ceiling |
| Activity log | What your technicians and the client’s people did, with an export that can be verified | Name technicians in the activity log |
What you decide for each client
Section titled “What you decide for each client”| Decision | Where |
|---|---|
| Whether the portal is on, and who is invited | The client’s Client portal tab, Overview and Users. See Turn on the portal for a client. |
| The most any portal user at the client can do | Permission ceiling. See Set portal roles, groups, and the permission ceiling. |
| Whether portal users can use remote access, and how | Remote access. See Let clients use remote access. |
| Single sign-on and directory sync | SSO and directory. See Set up single sign-on and directory sync. |
| A different look from your other clients | Branding. See Brand the client portal. |
| Whether technicians appear by name | Audit naming. See Name technicians in the activity log. |
Settings that apply to every client are on Settings > Client portal: branding, custom domains, SSO apps, Microsoft Teams, and defaults.
Who can do what
Section titled “Who can do what”| Task | Permission |
|---|---|
| See a client’s portal settings, users, requests, and approvals | clientportal:read |
| Turn the portal on or off, set the ceiling, SSO, audit naming, Teams, and defaults | clientportal:manage |
| Invite, suspend, and offboard portal users; edit roles and groups; work requests | clientportal:users |
| Set the remote access ceiling and grant remote access | clientportal:remote |
| Edit branding | clientportal:branding |
| Add and remove custom domains | clientportal:domains |
Every role that holds client:manage is given all six. See
Client portal permissions.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.