How to Build a Client Portal Without Code (Using AI)

A client portal is a private website where each client logs in to see their own projects, files, invoices and messages. With an AI app builder, you describe your clients, what they should see and what you upload. It builds accounts with roles, private file storage behind expiring links and an admin area for your team.

• Design the data first: clients, users, projects, files, messages and invoices, each tied to exactly one client.
• Every page and every file must check who is signed in. Test it by trying to open one client's page while logged in as another.
• Private files are served only through download links that expire within minutes, after the portal confirms the file belongs to that client.
• Email notifications and password resets need your own SMTP account; Stripe payments need your own Stripe keys. Both go under Integrations.
• Put the portal on an address like portal.yourfirm.com with a single DNS record, on any plan.

What a client portal does, and what it doesn't need

A client portal replaces the email threads where work gets lost: "which version is final?", "did you get my bank statements?", "is invoice 1042 paid?". Each client signs in and finds one tidy place with their project status, the files you shared, the files they sent you, messages tied to each project and their invoices.

It is useful wherever work is recurring and document-heavy. An accountant collects year-end documents from forty clients. A design agency shares drafts and collects approvals. A consultant keeps reports and meeting notes per engagement. A photographer delivers finished galleries.

What a first version does not need: live chat (threaded messages per project are enough), a native mobile app (a web portal works in any phone browser), complicated permission matrices, or single sign-on through a corporate identity provider. Start with the smallest portal your clients would actually use and add to it once they do.

Portal subscription tool vs AI-built portal

The alternative to building is subscribing to a ready-made client portal product. Both are reasonable; they suit different firms.

Choose a subscription tool if you need built-in e-signatures, ready accounting integrations or formal compliance certifications. Build your own if your workflow is specific, per-client pricing hurts as you grow, or you want the portal to look and speak like your firm.

Design the data: clients, projects, files, messages, statuses

Ten minutes of planning here saves several rebuilds. Write down the records your portal keeps and which client each belongs to:

Two rules make everything else easier. First, every record carries the client it belongs to; that single field is what lets the portal filter correctly. Second, users belong to clients, not the other way round, because a client company often has two or three people who need access.

Keep statuses short and written from the client's point of view: "Not started", "In progress", "Waiting on you", "Delivered". A client who sees "Waiting on you" knows exactly what to do.

Step-by-step build with a prompt template

1. Write down your records, roles and statuses using the table above.
2. Open a chat in WisyLink. The free Community plan is fine for a prototype; real clients need a paid plan, because free links are deleted after 30 days plus a week.
3. Paste the prompt below, adapted to your firm.
4. Answer Wisy's question if it asks one, then let the build run. The final note tells you how to sign in as admin and which Integrations are waiting for keys.
5. Create two test clients with one test user each, and add a project and a file to each.
6. Add your SMTP details and, if you take payments, your Stripe keys under Integrations.
7. Run the security checklist further down this guide.
8. Connect your domain, then invite one friendly client before everyone else.

Build a private client portal for [firm name], a [type of firm]. No public sign-up: only admins create accounts.

Roles: admin (me), staff (my team) and client. Each client company can have several users. Client users must only ever see their own company's projects, files, messages and invoices.

Projects have a title, status (Not started, In progress, Waiting on you, Delivered) and due date. On each project, both sides can upload private files up to 25 MB and post messages.

Invoices: number, amount, due date, status and an attached PDF, with a Pay now button through Stripe for unpaid invoices. Mark an invoice paid only when Stripe confirms it.

Email clients when we upload a file or post a message, and email me when a client does. New users get an email invite to set their password. Use our colours [colours] and a calm, professional style.

On the free plan, Wisy keeps each build to a first working slice, so expect logins, projects and files first. Ask for messages and invoices in follow-up messages. Each change is a new build, and a failed build leaves the previous version live. For a broader explanation of how this kind of tool works, see what an AI app builder is.

Logins, roles and "each client sees only their own data"

The portal runs its own accounts. Passwords are stored hashed, sessions live in HttpOnly cookies, repeated failed logins are throttled, and roles are enforced in the portal's own pages and routes. There is no platform-provided login and no SSO or SAML. If clients want "Sign in with Google", the portal can offer it using OAuth credentials you create in your own Google account and paste under Integrations.

Three roles cover most firms:

Admin

You. Creates clients and users, sees everything, manages invoices.

Staff

Your team. Uploads files and replies to messages; ask for staff to be limited to assigned clients if that matters.

Client

Sees and uploads only within their own company's projects.

Make the portal invite-only. If anyone can register, strangers can create accounts, even if they see nothing. With SMTP set up, an invite email lets each new user choose their own password; without it, you set a temporary password and share it by phone.

Is an AI-built client portal secure?

The platform side is solid: each site runs on its own compute, unsigned requests are rejected before any code runs, the build agent has no standing access to your account or keys, and keys under Integrations are encrypted and never shown again. The part to verify is your own access rules. Broken access control is ranked first in the OWASP Top 10:2025, which reports that every application it tested had some form of it. A typical example is opening someone else's record by changing an ID in the address bar. The fix is that every page looks up the signed-in user's client and filters on it, rather than trusting the ID in the URL. Test it: sign in as Client A, copy a project address, sign in as Client B and paste it. You should get a not-found page.

Private file sharing with short-lived download links

File sharing is usually the reason firms want a portal, so it is worth knowing exactly how it works. Files go straight into the site's private storage, and the portal records which client and project each belongs to. When someone clicks Download, the portal checks that the signed-in user may see that file and only then creates a signed link that expires within minutes. If a client forwards that link, it stops working shortly afterwards; the file itself never sits at a public address.

Can clients upload files to me?

Yes. Clients can upload on their own projects, and you can upload to theirs. Each file can be up to 25 MB, and PDFs, images, office documents and zip archives all work. Every upload counts toward your plan's storage and bandwidth, and so does every private download. You can see how much you are using in the Resources panel of your account.

Three practical habits keep storage under control:

• Ask for an archive or delete action on old projects, so finished work doesn't fill your storage.
• For very large deliverables, such as video masters or big image archives, use a file transfer service and post the link in the project.
• Ask for uploads to show the uploader and date, so "which version is final?" answers itself.

Email notifications for new files or messages (SMTP)

The portal sends email through your own SMTP account: the outgoing-mail settings from your email provider. You paste the host, port, username, password and sender address under Integrations. Until you do, the portal works but sends nothing, which also means invites and password resets cannot reach anyone. Set up SMTP before you invite clients.

Useful notifications are:

• To the client: you uploaded a file, posted a message or issued an invoice.
• To you: a client uploaded a file or replied.
• To new users: an invite to set a password, and password reset codes.

Never put a download link in the email. Signed links expire within minutes, and an email might be read hours later. Link to the project page instead, where the client signs in and downloads. If per-event emails get noisy, ask for a summary email to you instead: scheduled jobs can run every 30 to 60 minutes and send one round-up of what clients uploaded.

Invoices and payments through your Stripe account

Many firms keep invoicing in their accounting software and simply attach the PDF to an invoice record in the portal, with a status they update by hand. That is a fine first version. If you want clients to pay inside the portal, the builder can add a Pay now button that uses your own Stripe account.

The flow is built the safe way: the portal records the payment attempt first, sends the client to Stripe's checkout, and marks the invoice paid only when Stripe's signed notification confirms it, never because the client landed on a "thank you" page. You add your Stripe keys under Integrations; the setup instructions appear there, and payments stay inactive until you do. Use Stripe's test mode first, pay one invoice end to end, then switch to live keys.

Two caveats. WisyLink never holds your payment account, so Stripe's own fees and terms apply. And Stripe is not available to businesses in every country; if it isn't in yours, any payment provider with an API can be connected the same way. For a monthly retainer, the portal can store each client's subscription status and show it on their dashboard.

Security checklist before inviting clients

Run this list once before launch and again after any change that touches accounts, roles or files:

1. Isolation: with two test clients, try every project, file and invoice address of one while signed in as the other.
2. Admin pages: visit the admin area while signed in as a client; you should be refused.
3. Sign-up closed: in a private browser window, confirm there is no way to create an account without an invite.
4. Expiring links: copy a download link, wait 15 minutes and open it again; it should fail.
5. Admin password: replace any starting password from the build note with a long, unique one.
6. Email: send a password reset to a test user and check it arrives, including in spam folders.
7. Payments: complete a test payment and confirm the invoice turns paid only after Stripe confirms it.
8. Capacity: check the Resources panel for headroom on storage, database and bandwidth.
9. Clean-up: delete test clients, files and invoices.
10. Keys: confirm no key or password was ever pasted into the chat; they belong under Integrations only.

Two honest limits to weigh: WisyLink publishes no data-location statement or compliance certifications, so if a client contract demands them, ask before you commit. And WisyLink's terms make you responsible for testing what the AI builds, which is exactly what this checklist is for.

Finally, give the portal its own address. With a single DNS record you can connect a subdomain like portal.yourfirm.com while your main site and email stay where they are; the steps are in connecting a custom domain. You can connect your own domain on any plan, the free one included; to keep the portal live past 30 days, compare plans in pricing.

Build your client portal this week

Write down your records and roles, adapt the prompt above and send it. Sign in as admin, create two test clients and try to break the isolation before any real client logs in. If you are still weighing whether to build it yourself or brief a freelancer, the comparison of an AI app builder vs hiring a developer walks through that choice.

You can build and test the first version free: start on Community, no card required. For the details of how each site is isolated and deployed, read how WisyLink is built.