My Client Portal Started as a Door to Nowhere. Three Weeks Later It Runs the Engagement.

The first version of my client portal was a login button that went nowhere. On October 10 I needed clarentconsulting.com live before a golf outing whose sign pointed at it, and a "Client portal" link makes a one-person firm look like a firm. There was no sign-up, no fake dashboard, just a line saying clients get their credentials from me.

Two days later it was real. Three weeks and forty pull requests later, it's the part of the business I'd rebuild first if I lost everything. Here's how it got there, version by version.

Version 1: the door (Oct 10)

A placeholder, but an honest one. It never sent credentials anywhere and it said so. Its job was to tell a prospect that clients get a private space, before I'd decided what that space did.

A placeholder is fine as long as it doesn't lie. Mine said accounts come from me directly. That was true.

Version 2: documents in, documents out (Oct 12)

Magic-link sign-in, document requests, uploads into private storage, deliverables, and a review that gave the whole thing one vocabulary. I wrote that day up in Part 8.

Two things from that day turned out to matter more than the features. The database I use pauses after a week of silence, so a free scheduled job writes one timestamp twice a week to keep it awake. And a security review the next day found no way for one client to see another's files, but tightened four things anyway, including a real rate limit on the contact form.

Version 3: Claude got write access, so I needed a draft stage (Oct 23)

The biggest change came from how I work, not from a client. Most deliverables I share are built with Claude driving: a report as a web page, an analysis, a document. Once Claude could push a deliverable straight into a client's portal, "skip the notification" wasn't enough. The file was already visible.

So deliverables are now drafts until published. Claude can stage as much as it wants; nothing reaches the client until I've looked at it and clicked Publish, with or without an email. And I got a View as client mode, the client's exact screen with every control disabled, so I can check what they'll see before they see it.

The moment an AI can write to a client-facing system, you need a review step between it and the client. Build that before you build anything else.

Version 3, part two: I dropped invoices

Part 8 ended with a plan to show Mercury invoices in the portal with a pay button. I've cut it. Creating invoices through Mercury's API needs a key tied to fixed internet addresses, which my hosting doesn't have unless I pay $100 a month for them. A read-only sync was possible but added a moving part for the sake of a button Mercury already emails the client. So invoices live in Mercury, the portal stopped mentioning them, and I'll revisit when the volume justifies it.

Version 4: the portal stopped being an island

By mid-October I was tracking every engagement twice: once in my CRM, once in the portal. A deal would move to Active in one place and nothing happened in the other.

Now a won deal becomes a portal client in one click. The dialog lists the deal's people, I tick who gets invited, and the client space opens with the invites already out. The deal shows the portal's status; the client page links back to its deal. Internal working documents stay in Google Drive, linked from the deal. Anything the client should see lives in the portal. That required leaving Attio, which is the next post.

What I'd tell someone building one

• Ship the door before the room. A placeholder bought me two days and a golf sign.
• Decide once where a document lives. Internal in Drive, shared in the portal, nothing in both.
• If an AI can publish to your clients, add a draft stage. Review first, then publish.
• Cut features that duplicate a tool you already pay for. Mercury sends the invoice. It doesn't need my help.
• Watch for the same fact stored twice. It's the earliest sign two tools should be one.

Questions I get about this

Why not just share a Google Drive folder with each client? I still use Drive, for the internal side. It's good at holding files and bad at status. A client can't see what I'm waiting on, and I can't see what they've opened. The portal's job is the conversation around the file, not the file.

Is it safe enough for sensitive documents? Files sit in private storage. Download links expire after sixty seconds, every view is logged, and a review found no cross-client access. That's the bar I'd want from any tool I asked a client to use.

Could I use something off the shelf? For most firms, yes, and you should. I built mine because I want to understand the pattern well enough to set it up for clients, and because it now connects to everything else I run.

If you run a small practice and still move documents by email, ask me what this took. If you use an off-the-shelf portal and love it, tell me which one. I'd like to know what I'm competing with.