Your customer calls: "When will my deal close?" Your admin calls back four minutes later. Repeat 30 times a day. A client portal solves this — but Notion-shared-pages have zero auth, and ClientPortal SaaS charges $59/mo per seat. Velocity X ships with a third option: magic-link email auth, per-customer row isolation via Supabase RLS, and a branded portal landing inside your site. Customer clicks an email link, lands in their personal dashboard showing only their deal, invoices, and support tickets. No password reset emails, no seat counting.
What Magic-Link Auth Actually Does
Traditional login: username + password stored in your database. Customer forgets it. Resets it. You manage password policy, rotation, compromise risk.
Magic-link auth: customer enters only their email. Velocity X emails them a one-time link (expires in 24 hours). They click it, land inside their portal. No password stored. No "forgot password" flow. Supabase Auth handles the token generation and session lifecycle — you just check: "Is this valid?". Two-factor auth is built in (the email itself is the factor).
The Architecture
Supabase Auth hands out a JWT after the magic-link click. Velocity X reads that JWT in the portal route, extracts the customer ID, and queries the database with RLS enabled: SELECT * FROM deals WHERE customer_id = $1. The database itself enforces isolation — a compromised JWT can only read rows that match the customer's ID. No admin oversight needed.
Portal pages are Astro server-side rendered with the JWT in the Supabase client context. When the customer logs out, the session token expires. Next visit, they get an email link again. Simple, stateless, impossible to leak data to the wrong customer.
Why It Beats Password-Based Portals
Passwords fail silently — forgotten, reused, phished. Velocity X magic-links are ephemeral: the token works once, for 24 hours. Customer loses the email? Send another in 10 seconds from the login form. No "security questions", no account lockouts, no support tickets for resets. Data breach? Hashed tokens are worthless without the email account itself. Your liability shrinks.
Use Cases
Real estate: buyer sees their contract + comps + inspection timeline. Legal: client views discovery docs + invoices. Accountants: customer downloads their tax return + linked statements. Agencies: client reviews project status + deliverable uploads. Insurance (hello Rebuild Relief): homeowner tracks their claim + adjuster notes + payment schedule. Every field-service business has a version of this need.
Compared to ClientPortal SaaS
ClientPortal charges $59/mo per customer access (it adds up fast). Embed fees, white-label addon, per-deal fees. Velocity X is bought once. RLS scales to 1,000 customers with zero per-seat cost. Integration is native (your database is already Supabase). Custom fields, custom branding, deal-linked documents — all in your codebase, not locked behind UI settings.
Frequently Asked Questions
What if the customer's email is compromised?
The attacker gets one magic-link email. Velocity X invalidates all tokens when you revoke the customer's auth record. No standing password to crack. One admin action blocks them instantly.
Can customers invite other team members?
Yes. Portal form lets the customer add collaborators (internal team members with their own email). Velocity X issues separate magic-link tokens for each. RLS still isolates them to the same customer's deals.
How do I log customers out if they leave the company?
Disable the customer record in the auth_users table. All active sessions become invalid on next API call. No password reset, no "logged in on three devices" mess.
Does this work for multi-tenant SaaS?
Yes. RLS policies can isolate by customer_id and organization_id. Velocity X uses the same pattern. Magic-link is actually preferred for SaaS onboarding — frictionless signup.
What about GDPR / CCPA data export?
Customer requests their data, you run a Supabase query filtering by their auth ID, export JSON. No password-reset tokens to clean up. RLS makes the query safe — you can't accidentally leak other customer data.
Can I disable the portal for specific customers?
Set a portal_enabled boolean in the customer record. RLS policy blocks the query if false. No code changes, no feature flags.
The Bottom Line
Magic-link auth is the default for B2B portals now. It's faster to code (Supabase handles the hard part), safer (no passwords, RLS enforces isolation), and cheaper (no per-seat SaaS). Velocity X includes it because every customer-facing business needs one. Build it once, port it every time you clone the template.