Who can see each document in the portal

In the client portal, access isn't all or nothing: each document has its own authorized people, and WorkOS checks it every time someone opens it.

Ways to get access

A person sees a document if they sign in with an email that meets at least one of these conditions. If the email appears on several CRM records (duplicate contacts), all of them count.

1. They're a CRM contact linked directly to the document (the CRM link property).
2. They're a CRM contact linked to the same Project or service as the document (the Relation to Projects property).
3. They're a contact of the Company linked to the document, or of the Company of the document's Project or service.
4. They're on the team and appear as the document's Owner or a Participant (the Document owner (relation) and Participants (relation, multiple records) properties).
5. They're on the team and are the lead or a participant of the document's Project or service.
6. They're on the team and are responsible for the Company linked to the document or to its Project.

A team member with a WorkOS account who meets none of the conditions above doesn't get access.

Besides having access, the document must be shared with the portal and its Status must be one of those visible in the portal; otherwise it doesn't appear in the list.

Private documents and documents of private Projects are stricter: a private document that its owner shares with the portal opens only through ways 1, 2 and 4 (a contact linked to the document or its Project, and the Owner or Participants), and a private Project doesn't open its documents to contacts or to someone who is only responsible for the Company; only to its members.

For this to work, map at least one of those properties in Settings → Notion databases → Documentation configuration. With none, nobody can get in.

Share a document

1. Open the document and click Share with client. In the detail bar it looks like an icon.
2. A panel opens with the Portal link and a button to copy it. When you open it, WorkOS activates that document's link.
3. Below you see who has access. Linked via project or service are the contacts who arrive through the Project, each with a Send email button to send them the link. Under Other contacts are those linked directly to the document: here you can Add contact or remove one.

A document nobody has shared doesn't appear in the client's list or Desktop, and the contact needs a valid email in your CRM. If the document doesn't have anyone with access yet, the panel tells you so.

Remove access

Remove the contact from Other contacts, or delete the relation in Notion (for example, by changing the document's Project). The next time that person opens the document they'll see they no longer have access: WorkOS checks again on every opening, not just at sign-in.

Privacy

If someone asks for a code with an email that has no access, WorkOS doesn't tell them whether the email exists: it shows a generic message, "If the link is valid, we've sent a code to that email."

How long changes take to show

To keep the portal fast, the Desktop's document list is kept for about 45 seconds. If you have just granted or removed access, or changed a document's title or Status, the list can take up to that long to reflect it. When someone opens a document, its attachments or the PDF, WorkOS always checks access again at that moment.

Who can sign

Viewing a document and approving it are different things. It can be approved by people linked to the document itself or to its Project or service (and by the Owner and Participants). Company contacts and team members who see it through other routes can read it, but are not offered the "Approve" button.