Loading
Loading
The fastest path to put a customer in their own self-serve portal: text or email them a magic link from the customer detail page. They tap once, they're in. No password setup, no app install, no forgotten-credentials tickets to your front desk. Every send mints a fresh 30-day token — the old one keeps working too, it isn't revoked. The mobile app's SMS-code login mints a similarly-shaped token into the same table, though the two flows currently generate different-length hex strings under the hood.
Sarah Chen
555-014-2821 · sarah.chen@hey.com
Customer detail page
Clicking "Text to customer" mints a fresh 30-day link and sends it — the button label briefly changes to "Texted!" for about 2.5s, then reverts. No delivery or read-receipt tracking is kept.
Features, zoomed in
Three capabilities built specifically for the day-to-day of a working shop.
Deep dive · 01
From the customer detail page, click 'Portal link' → Copy link, Text to customer, or Email to customer. Sending mints a fresh token and delivers it through the existing Twilio + Resend stack; the button label flashes 'Texted!' or 'Emailed!' for a couple seconds as confirmation. There's no per-row send button on the customer list — this lives on each customer's own detail page.
Sarah Chen
555-014-2821 · sarah.chen@hey.com
Customer detail page
Clicking "Text to customer" mints a fresh 30-day link and sends it — the button label briefly changes to "Texted!" for about 2.5s, then reverts. No delivery or read-receipt tracking is kept.
Deep dive · 02
Tapping the link drops them at /portal/<token> — no login form, no account creation, no app install. They see their own appointments (with a link to before/after photos once a job is complete, or reschedule/cancel while upcoming), quotes, invoices with balance owed, warranty status, their vehicles, and a loyalty card. Token-scoped, so they only see their own data.
Sample Shop LLC
Hi Sarah
Appointments
Front 2 Ceramic 70/35
COMPLETEDMay 20
View before/after photos →
Invoices
$1,840.00
PAIDWarranties
Ceramic IR 70
ACTIVECert #WR-4021 · Registered May 20
Loyalty Card
4/6No login required · link expires in 30 days
Deep dive · 03
The token is stored in plain text in customer_portal_tokens (there's no hashing step) and validated server-side on every request, expiring in 30 days. Web-issued links use a 48-character hex token; the mobile app's SMS-code login flow mints a 64-character hex token into the same table. Token-scoped means no auth bleed between customers, even on a shared phone.
🔗 Web · magic link
48-char hex token
a3f9e2c8b1...(48 chars)
randomBytes(24).toString("hex") — /portal/<token>
📱 Mobile · SMS code
64-char hex token
8h2f4d91...(64 chars)
randomBytes(32).toString("hex") — verifyCode() mints it
↓ both insert into ↓
customer_portal_tokens
id
uuid
customer_id
uuid
token
plain text
expires_at
+30 days
used_at
null until first use
One table, stored as plain text (not hashed) · 48-char (web) or 64-char (mobile) hex · 30-day expiry · reusable until it expires
What's included
Everything that ships on day one. No feature-gating surprises inside a single plan.
See every angle
Every meaningful view, the path through it, and the moments that matter — so you know exactly what you're buying.
Customer-facing portal
Sees appointments, quotes, invoices, warranty status, vehicles, loyalty card. Token-scoped, no auth bleed.
Sample Shop LLC
Hi Sarah
Appointments
Front 2 Ceramic 70/35
COMPLETEDMay 20
View before/after photos →
Invoices
$1,840.00
PAIDWarranties
Ceramic IR 70
ACTIVECert #WR-4021 · Registered May 20
Loyalty Card
4/6No login required · link expires in 30 days
How it works
From any customer page, click 'Portal link' → pick Copy, Text, or Email. A fresh token is generated and sent via the existing Twilio / Resend stack.
Lands at /portal/<token>. The token is validated server-side (expiry check only) before the page renders. Customer sees their own data scoped by that token.
Expires at +30d. The operator can send again any time — that mints a new token but doesn't revoke the old one, so an older link a customer already has keeps working too. Customers can bookmark the URL and use it until it expires.
What this looks like in a shop
Illustrative scenario: Sample Shop LLC just finished a $1,840 ceramic coating. Mike opens Sarah's customer page, clicks 'Portal link' → Text to customer. She gets an SMS with a link to view her job. She taps it, sees her warranty status and her invoice. No account creation, no support call, and Mike never had to email her a PDF.
Questions
Explore more
One Expo app, two login flows. Customers type name + phone, get a 6-digit SMS code, land in their own portal. Staff use email + password. Role decides which tabs they see.
Every customer conversation in one inbox. Auto-reminders run 24/7, but when they reply, a human sees it. MMS, templates, merge fields.
Register a warranty when a job's done and SalesThumb emails a branded PDF certificate with a public verification link. Customers can file a claim from that same link.
Every appointment gets a photo gallery. Techs capture on mobile. Customers see a polished post-install gallery. You protect yourself from 'it was like that when you got it' claims.