Client Portal — one branded hub for an agency drowning in tabs

The problem

The agency was drowning in tabs. Leads lived in one CRM, client chats in another tool, campaigns across a third. Every time an account manager needed to answer “what's happening for this client this week?” it meant opening five tabs and piecing the story together.

They needed one place — per client — where everyone (agency-side and client-side) could see the same picture in real time.

Constraints

• Multi-role from day one. Agency owners, account managers, client admins, client viewers. Each needed a different view. Nobody should ever see anything they shouldn't.
• Fully white-labelled. Each client's own subdomain, logo, colors, and email sender. Not the agency's.
• Live CRM data, not exports. Stale weekly reports were part of the original problem.
• Real billing. Subscription tiers, prorations, upgrades. Not a stub.

What I shipped

• Multi-role access with row-level permissions. Every seat sees only what it should.
• Live dashboard pulling directly from the CRM API. Refreshes on its own.
• In-app messaging, booking, and file exchange — the three most common reasons to leave the portal, now inside the portal.
• Stripe subscription billing with a customer portal for upgrades, downgrades, and card management.
• Automated onboarding email sequences triggered by Stripe events, not by someone remembering to send them.
• Self-serve white-labelling — clients paste a DNS record, portal detects it, SSL gets auto-provisioned.
• Deployed on AWS + Vercel with staging and production separation, backups, and uptime monitoring.

The hard parts

Row-level security done properly. Multi-tenant SaaS with four role types is where “we'll figure out permissions later” becomes an incident report. I built the permission model in Supabase RLS policies before the first UI screen. Every query gets automatically scoped. The app literally can't leak data because the database refuses to serve it.

White-label DNS and SSL that clients set up themselves. Each agency client needed their own domain pointing at the portal. I built a self-serve verification flow — paste a domain, get a DNS record, portal auto-provisions SSL via Let's Encrypt. No support ticket needed for new client onboarding.

Keeping billing state in sync. Stripe subscriptions can pass through a dozen statuses. I use webhooks with retries and idempotency keys, plus a nightly reconciliation job that re-syncs subscription state as a belt-and-braces. Never had a “paying customer locked out” incident.

Result

Live since 2023, in daily use by the agency. New client onboarding went from half a day of manual setup to something the client does themselves in under 15 minutes. They've since added tiers, iterated on the dashboard, mostly without touching the codebase.

What I'd do differently

Invest in a design system earlier. The early screens got iterated so much that by v1 half the design tokens were duplicated across components. Proper Figma library + code tokens on day one would've saved a full week of consolidation later.

Takeaway

The value in a portal like this isn't any individual feature. It's the removed switching cost. Every tab you can collapse into one place is a small productivity win — but the aggregate is a genuinely different way of running client work.