Portal settings
Portal settings
Who can do this: Manage Members. The dialog is External Portals in the space menu. If you cannot see it, see the .
What it's for
This is the reference for the External Portals dialog, titled "External portal" followed by your space name. It has four tabs: Overview, Start pages, CORS settings and Sign-in email. For the end-to-end setup (groups, invitations, access), read first. The settings that belong to one item or to the people list are summarised at the end of this page.
Before you start
Plan: no plan requirement was found in the code for these tabs.
Needs your administrator: three things in this dialog depend on the installation, not on your space. (1) The public address of the installation: without it the Portal URL is only a guess and invitations fail. (2) Outgoing email: the default sender of sign-in emails is the platform mailbox. (3) AI providers, for the AI assistant. Ask for "the Public App URL and outgoing email (SMTP) under System → Config, and an AI provider". See .
Overview
Item | What it does | Default | Risk |
|---|---|---|---|
Portal URL | The address you give customers. Copy copies it; Open portal opens it in a new tab | Built from the installation's public address | See "Address fallback" below |
AI assistant | Lets signed-in customers chat with a read-only assistant. It can search and read only what that customer may open. Separate switch from your team's agents | Off | Each question uses AI. The portal limits how often one customer can ask |
Exposed documents | Count of items published to the portal | none | A count of zero means nobody can see anything |
External groups | Groups whose audience is External | none | Zero means nobody can be given access |
Portal users | Total, verified, blocked, and group memberships | none | |
Active sessions | Customers currently signed in | none | |
Send sign-in link + Send | Emails one person a sign-in link now. The account row is created when they actually sign in | empty | Uses the sign-in email settings below. Limited to five emails per address per hour |
When nothing is exposed or no external group exists, an amber box titled "Portal isn't reachable yet." lists the missing steps. Its steps match the current screens: create an external group under External Users → Groups, switch on Publish in the external portal in External users access… on a folder, then grant the group read on it.
Address fallback
If the installation has no public address set, the Portal URL shows the address your browser is on, with an amber warning that it should be fixed so the URL "is authoritative across hosts".
Careful: do not send that fallback address to customers. It is whatever address your own browser is using, which may be an internal or temporary one that customers cannot reach or that changes later. Ask your administrator to set the public address, then copy the URL again.
Start pages
Choose the document a customer opens first. You set one per Group, Company or User. If several apply, the order is user, then company, then group. If a person is in several groups, the start page set most recently wins. A start page the customer cannot open (it is not published to the portal, or the customer has no read or submit right on it) is skipped and the next one is tried. A link to a specific document, or to an assigned form, opens that instead of the start page. With none set, customers land on an empty page ("Select an item") and choose from the tree.
The labels on this tab are shown in English only: "Configured start pages", "Add a start page", "Show portal tree", "Set as start page".
Pick the kind (group, company or user) and then the one you mean.
Choose "Show portal tree". The tree shows what that group, company or user can actually reach. You can only pick items they have access to.
Select a document and choose "Set as start page".
To remove one, use the red bin on its row. Only one start page per target; setting it again replaces it. If the tree says the target "can't reach any documents yet", grant access first (see the chapter).
CORS settings
The tab is headed Allowed origins (CORS). The list starts empty: "No origins allowed yet."
What it is
An origin is a website address: https://app.example.com. It has a scheme, a host and an optional port, and no path. If a customer builds their own web app on their own site and wants it to talk to your portal or your public forms from the visitor's browser, you must list that site here. Browsers refuse the call otherwise. Customers who only use the hosted portal do not need anything on this tab.
Careful: every entry is a trust grant. It lets any page on that website:
•call this space's portal and public form services from a visitor's browser, with the visitor's portal sign-in;
•read every answer that a signed-in portal user on that site would receive;
•find out which space addresses, document numbers and row numbers exist on this server, from the difference between "not signed in" and "not found" replies;
•be a valid destination for sign-in links, and skip the extra anti-bot step on portal sign-in.
Add only websites the customer controls. Never add shared hosting or sandbox sites such as
codepen.io,jsfiddle.netor*.vercel.app. Anyone can publish a page there, and that page would get all of the above. A wildcard widens the grant to every site under it. Do not add one unless you control every site under it, or the customer does.
Allowed formats
Format | Example | Matches |
|---|---|---|
Exact origin |
| Only that host, scheme and port |
One-level wildcard |
|
|
The wildcard must be the first part of the host, with exactly one star, and what follows it must contain a dot. The scheme and the port must also match.
What is rejected
The tab marks the row red and refuses to save with "Fix the highlighted entries before saving." It rejects:
a lone * ("match everything"), in any form;
an address with a path (anything after the host), a query (?…) or a # part;
an address with a user name or password in it;
a scheme other than http or https;
a star anywhere but the very start of the host (https://app.*.com), more than one star, or a wildcard with no dot after it (https://*.com).
Plain http:// addresses are accepted by the check, but prefer https://. Blank rows are dropped and duplicates are merged on save.
Effects and timing
Saving replaces the whole list and shows "Allowed origins saved".
Removing an entry stops new requests at once. Browsers may remember an earlier "yes" for up to 10 minutes.
Your own addresses need no entry: the space's own address, its verified custom domains and its storefront addresses are trusted automatically. Your administrator can also add a server-wide list that you cannot see on this tab.
How to check it worked
Open your customer's app and load a page that calls the portal. If the browser console reports a CORS error, the origin is missing or typed differently (scheme, www., port).
Sign-in email
The email customers get when they sign in or are invited: a sign-in link and a 6-digit code. Empty fields keep the built-in wording. The right-hand side shows a live Preview of the real email, and a Code-only request switch for the code-only variant. Choose Save to apply. Nothing is sent when you preview.
When your space has at least one directory, Applies to lets you set one layer for Every sign-in (default) and an override per directory. Empty fields in a directory layer use the default layer.
Setting | What it does | Default | Risk |
|---|---|---|---|
Display name | Name in the subject, heading, button and sender name | Your space name | Customers may not recognise an unfamiliar name |
Logo URL | Image in the email | None | The image must be reachable from the public internet |
Button colour | Colour of the button | Built-in | |
Language buttons, Subject, Introduction, Footer, Button text | Wording per language. Plain text. Placeholders: | Built-in wording | A language you leave empty falls back to the built-in text for that language |
Email contains | Link and code, or Code only (no link) | Link and code | Code only works only if your app accepts the 6-digit code |
Link opens | This platform, then your app, or Your app directly | This platform, then your app | "Directly" puts a live sign-in token in a link to your page. That page must be an allowed origin. Sign-ins without a return address keep the platform link |
Your app’s sign-in page | Where links the platform sends by itself open | Empty | Must be an allowed origin |
Link works | On every device until it expires, or Once (secure mode) | On every device | Anyone the email is forwarded to can sign in until it expires. Use Sign out on all devices to end it early |
Link expires after (hours) | Lifetime of the link | 72 hours; 15 minutes in secure mode. Allowed: 1 to 720 | The code always expires after 15 minutes |
Send from | Platform mailbox, or an email connector of this space | Platform mailbox | If your connector fails, the platform mailbox is used instead, so a mail may come from a different sender than you expect |
Invitations sent from External Users → Invitations do not use these settings: they carry a fixed 24-hour link.
Settings that live elsewhere
These belong to this feature but are opened from other places.
Changing the session lengths does not sign anyone out. The values are read when a person signs in and each time a session is renewed. A session that is already open keeps its current expiry until its next renewal. After that renewal the new Stay signed in for (days) applies, a shorter value included, and Sign in again after (days) is counted from the original sign-in. Renewal is done by the app that holds the session: a customer app built on the portal client renews through the portal's refresh endpoint. The built-in portal at /portal/<alias> does not call it, so there a session ends at the expiry it got when the person signed in, and a changed value reaches only new sign-ins. The hint under Stay signed in for (days) says the same. Accounts that are not linked to a directory row always use the 14-day default.
Undo / what can go wrong
Situation | What happens |
|---|---|
You save a CORS list with a mistake | Nothing is saved. Fix the red rows |
You add the wrong website | Remove it and save. Treat anything it could have read in the meantime as exposed |
You turn off AI assistant | The chat disappears for customers at once |