Every customer receipt includes a "View this visit" link that opens the customer portal. The link is a signed magic-link — no password, no account creation. This page walks through what's inside, how it's secured, and what to do if a link is shared or reused.
Anatomy of the link
The URL looks like https://poolstamp.com/portal/v/<token>. The <token> is an HMAC of the customer id + the visit id + an expiry timestamp, signed with a server-side secret. Nothing about the customer's identity is guessable — you cannot construct a valid token by trying variants.
What the link grants
- Read-only access to the visit's chemicals, photos, and repair items.
- Read-only access to the customer's upcoming schedule (next 30 days).
- The ability to pay the visit via the embedded Stripe link (no separate login).
- Not access to other visits — each token is scoped to a single visit.
Expiry
Portal links expire 90 days after the visit's completion. After that the link returns a friendly "This receipt has expired — contact your service provider" page. The visit record is still on file; the customer just needs a fresh link.
What happens if a link is shared
- The link works for whoever clicks it. This is a design choice — customers forward receipts to spouses, HOA boards, and property managers all the time.
- It only exposes that single visit's data. There is no lateral movement to other customers, other visits, or the operator's account.
Revoking a link
If a link needs to be killed early (customer left an angry review, misdirected email), open the visit in the web admin and click Revoke portal link. The old link 404s immediately. You can generate a fresh one and email it to the correct address.
Under the hood
Portal tokens are validated on every request against the current signing secret. Rotating PORTAL_TOKEN_SECRET (on the backend) invalidates every outstanding link. This is a nuclear option — reserved for a suspected secret leak.