The client portal is a branded, signed-in home that you give to a contact (a client, a customer, a partner). Instead of only receiving links by email, they sign in to your workspace's own address and find everything you've shared with them in one place, can download it, and can upload files back into a private folder.
It's built on top of Contacts and, for companies, Organizations. This guide covers setting the portal up, how a contact signs in, what they can see and do, and what to do when something goes wrong.
The client portal is a Pro feature. On Free, portal access can't be turned on and a workspace's portal address shows "Client portal is not available for this workspace."
1. Two switches, both required
For the portal to work at all, two things must be on — and they're checked every time someone tries to access it:
The workspace is on Pro.
Settings → General → Client portal → Enable client portal is on. It's on by default. Turning it off closes the portal for everybody and shows them "not available", without changing anyone's individual access setting.
On top of that, each contact needs Portal access turned on for them individually.
2. Setting it up
Give a contact access
Open Contacts and click the contact's name.
In the contact's actions menu, turn Portal access on.
The first time, Tarkle creates a sign-in for their email (or links the account they already have), marks the contact as having access, and emails them an invite. There's no password to set up — it's a single-use sign-in link.
You can also give a contact access by adding them as a new member to an organization with Send invite email ticked. Adding someone who's already a contact to an organization does not change their portal access.
The invite email
It carries your workspace logo and brand colour, and is sent from your custom email domain if you've set one up. The link points at your workspace's own address (your verified custom domain, or {workspace}.tarkle.com), so the contact never sees a generic Tarkle screen.
Managing access
Action | Where | Notes |
Resend invite | Contact page | Only works while portal access is on. Sends a fresh link; doesn't change access. |
Turn portal access off | Contact page | Takes effect immediately — their next click is refused. The contact record and history stay. |
Storage limit | Contacts list → row menu | How much that contact may upload (default 5 GB). Shown when portal access is on. |
Turn the whole portal off | Settings → General → Client portal | Closes it for everyone with one switch. |
Who can manage a contact's portal: the workspace owner, a team member whose role can add/edit contacts, or a member of the contact's own organization whose role can invite members (limited to people in their own organization).
3. Where the portal lives
A contact reaches the portal only on a workspace's own host: the workspace's verified custom domain, the fallback address {workspace}.tarkle.com, or a reseller (partner) workspace host. One contact can never reach another workspace's portal through their own link.
The workspace owner can't browse the portal with their own account unless that account is also a contact with portal access — the portal only recognizes contacts, so an owner just sees "not authorized".
4. Signing in
First time: the invite link
The contact opens the email and clicks the link. It checks the one-time link and signs them in directly — they land straight on the portal, or see a message that the link expired if it was already used or has timed out.
Next times: signing in again
They open their workspace's portal sign-in page, branded with your logo and colour.
They type their email and submit.
The page always answers the same thing ("check your email"), whether or not that email belongs to a contact — so nobody can use it to find out who your contacts are.
If the email belongs to a contact with portal access, in a workspace where the portal is available, Tarkle emails a fresh sign-in link. They click it and land on the portal.
What happens | Why |
"That sign-in link has expired or was already used. Enter your email for a new one." | The link is single-use and short-lived. Ask for another. |
"Too many attempts. Please try again in a few minutes." | Rate limits: 5 requests per email and 20 per network address in 10 minutes. |
Nothing arrives | The email isn't a contact, portal access is off, the portal is off, the plan is Free (the answer is deliberately identical either way), or it went to spam. |
Optional second step (2FA)
Contacts can protect their own account. In the portal, Personal profile has a Multi-factor authentication card where they can turn on an authenticator app and/or a passkey. Once either is on, the portal asks for it on every sign-in, after the email link, before showing anything.
Passkeys are tied to the domain they were created on. A contact whose portal is on a custom domain may not be able to finish the second step with a passkey there — the authenticator app works everywhere, so that's the more reliable option to recommend.
Staying signed in
Contacts stay signed in through their browser session, and can see and end sessions under Personal profile → Active sessions. Turning portal access off ends their access immediately, even if their session is still technically active, because access is re-checked on every request.
5. What the contact sees and can do
The sidebar has Home, Files, Shared, Requests, and a profile menu with Personal profile (plus Settings and Members if they belong to an organization). Everything is branded with the workspace's logo and colour.
Page | What's there |
Home | A welcome message, Upload and Folder buttons, a Storage card (their uploads against their limit), a Files card showing what you sent them recently, and recent transfers and files. |
Files | Everything shared with them, plus the contents of their own folder. |
Shared | The transfers sent to them or to their organization. |
Requests | Open file requests addressed to them, with an expiry date. A completed request shows a Completed badge and then leaves the list. |
Personal profile | Name, avatar, multi-factor authentication, active sessions. |
Hidden from the portal: transfers that expired or were burned, requests that are completed or expired, and deleted items.
Downloading
A contact can download what they uploaded and everything shared with them, except items whose only share is a view-only transfer — those are shown but can't be downloaded. Contacts can't rename, move, delete or share anything. Download and upload are the only actions available to them.
Uploading
Uploads and new folders always go inside the contact's own folder, named "Their Name (uploads)", created automatically the first time they open the portal. They cannot reach the library root or any folder outside their own.
Their upload allowance is 5 GB by default, adjustable per contact. Only what they uploaded themselves counts toward it — never what you sent them.
Their available room is also capped by your workspace's remaining storage, whichever is smaller.
Their uploads are normal library files, marked as uploaded by that contact, so they show in your Files and count toward your workspace storage.
Your plan's file-size limits apply to their uploads as they do to yours.
In an organization
A contact who belongs to an organization also sees Members (the team list, with an Add member option for those with the invite permission) and Settings (organization details; the Owner also sees an option to delete the organization, which requires typing its name to confirm). Items shared with the organization as a whole show to every member.
6. When the portal can't be shown
Message | Cause |
"Client portal is not available for this workspace." | The workspace is on Free, or the Client portal switch is off. |
"Not authorized" | The signed-in account isn't a contact with portal access in this workspace (including the workspace owner's own account). |
"Workspace suspended" / "deleted" | The workspace is suspended or deleted. |
"Organization suspended" | The contact's organization was suspended. Members were emailed when that happened. |
If a workspace downgrades to Free, contacts, their access flags, their folders and all history are kept — the portal simply stops serving until the workspace is Pro again.
7. Troubleshooting
Symptom | Likely cause and fix |
Contact says no email arrived | Check portal access is on for them, the workspace is on Pro, and the portal switch is on; check spam; use Resend invite. |
"Link expired" | Links are single-use. Have them enter their email on the sign-in page for a new one. |
They see "not authorized" | Wrong account (a different email than the contact's), or portal access was turned off. |
Can't upload | Over their allowance (raise their Storage limit), or the workspace itself is out of storage. |
A file they should have is greyed out or has no Download | It was only shared through a view-only transfer. |
A transfer disappeared | It expired, was burned, or its request was completed. |
Stuck at the second step on a custom domain | A passkey may not work there. Have them use the authenticator app, or sign in on the {workspace}.tarkle.com address. |