Portals

Umbrella surface for every public-facing portal — catalog, identity & recovery, audit log, and analytics across all app-owned portals.

MangoApps

Book a walkthrough Ask AI Download datasheet

Overview

Every MangoApps app with a public-facing surface — Job Board's Candidate Portal, Field Service's Customer Portal, eSignature's kiosk, Drive's share links — manages that surface on its own. None of them can show you all the others. Portals is the place that does.

The Catalog lists every portal's status, owning app, and a live preview. An admin turns any portal on or off right there — availability follows the owning app's license, but the switch itself lives in Portals. Identity & Recovery sets the one rate-limit and retention policy shared by every portal on the OTP / magic-link layer, backed by a searchable, SHA-256-hashed audit log. Branding and a verified custom domain apply once, to every branded portal.

Traffic Analytics rolls up visits across the portals wired into it. An admin-gated Ask AI agent answers status and audit questions read-only, so admins stop piecing the answer together app by app.

Platform

Highlights

See every public-facing portal in your business in one catalog — status, owning app, live URL, and a one-click preview — across 32 portal types.

Turn any portal on or off from a single registry; each portal's availability follows its owning app's license.

Track visitor traffic — page views, sessions, devices, top pages, and realtime activity — across your public portals, with CSV export.

Configure the shared OTP / magic-link recovery layer once — rate limits, attempt caps, retention — applied to every portal that opts in.

Investigate recovery abuse with a searchable, SHA-256-hashed audit log plus repeat-failure-IP and cross-portal signals.

Brand every public portal from one place — logo, colors, fonts, custom CSS — and map verified custom domains.

Capabilities

Portal Catalog & Control

Cross-app catalog of every public portal (32 types across 13 categories)
Enable / disable any portal from one place (PublicPortalConfiguration registry)
Availability gated by each portal's owning-app license
Status, owning app, category, and public URL per row
One-click live preview of each portal
Filter the catalog by category, status, or keyword

Traffic Analytics

Cross-portal visitor dashboard: page views, unique visitors, sessions
Bounce rate, avg time on page, and pages per session
Device breakdown (desktop / mobile / tablet)
Top pages across all portals
Per-portal drill-down analytics
Realtime active-visitor stats
CSV export of the full analytics dashboard

Identity & Recovery

Unified OTP + magic-link recovery layer (PortalIdentityRecovery concern)
Sliding-window rate limiting per identifier per portal
Configurable rate-limit window and max attempts
30-day effectiveness signals (sent / consumed / failed / rate-limited)

Recovery Audit & Security

Searchable audit log over every recovery event
Filter by portal, event, identifier hash, IP, and date range
SHA-256 identifier hashing — no plaintext email/phone stored
IP and user-agent capture per event
CSV export of filtered results
Automatic per-business retention pruning (PruneAuditJob)
Repeat-failure IP feed and identifiers-near-lockout signals
Cross-portal abuse detection (one identifier hitting many portals)

Recovery Analytics

Nightly cross-portal recovery rollup (DailyRollupJob)
Trend charts: requested / sent / consumed / failed / rate-limited
Per-portal totals and unique-identifier counts per window

Branding & Custom Domains

Business-wide portal branding: logo, favicon, background image
Primary / secondary colors, header colors, header + footer text
Google-font selection (primary + secondary)
Custom CSS and custom header/footer HTML (sanitized)
Live image preview while editing
Branding version history with one-click revert-to-defaults
Custom domain mappings with live DNS-TXT ownership verification
Domain activate / deactivate and verification-token regeneration

AI Agent (Ask AI)

Admin agent: recovery snapshot, portal status, anomalies, audit search
Admin-gated — members never see the agent's tools

Limits & Specs

Portals in catalog: 32 across 13 categories
Rate-limit window: 60 min default (1–1,440, configurable)
Max recovery attempts: 5 per window per identifier (1–100)
Audit retention: 180 days default (7–3,650, configurable)
Audit CSV export cap: 10,000 rows
Access: Admins, Super Admins & Portals app admins

Use cases

See every portal at a glance

Open the catalog to confirm which public surfaces are live — Field Service Customer Portal, Candidate Portal, Former Employee Portal, AI Front Office booking, eSignature kiosk, Drive share links, and more. Each row shows owning app, status, category, public URL, and a live preview link.

Turn a portal on or off in one place

Rather than hunting through each owning app, flip a portal's enable toggle right in the catalog. Portals writes the per-business registry; whether a portal is even available to toggle follows its owning app's license.

Watch external traffic across your portals

The Traffic Analytics dashboard rolls up page views, unique visitors, sessions, bounce rate, device mix, and top pages across your public portals — with a realtime view and per-portal drill-down — so you can see which public surfaces actually get used.

Investigate a recovery anomaly

A user says they never got their portal login link. Filter the audit log by their identifier-hash (or IP) to see whether the request was rate-limited, sent, or actually consumed — tracing the failure without ever exposing plaintext PII.

Tighten recovery security org-wide

Seeing a spike in failed OTP attempts? Drop the max-attempts cap in Identity & Recovery and every portal using the shared recovery concern picks up the new limit — while the Security tab surfaces the repeat-failure IPs behind the spike.

Brand portals and map a custom domain

Set your logo, colors, fonts, and even custom CSS once — changes apply immediately to every branded portal. Map a vanity hostname, prove ownership with a DNS TXT record, and activate it, all self-serve.

Resources

Portals Datasheet (PDF)

Datasheet

Features, capabilities, pricing model, and FAQ on one downloadable sheet — share it with your team.

MangoApps — Book a Demo

Website

Talk to the team about rolling Portals out alongside the apps that publish public-facing surfaces.

FAQ

Yes — the catalog is where you enable or disable individual portals, and Portals writes that per-business registry (PublicPortalConfiguration). What the owning app controls is the marketplace license: a portal only becomes available to toggle in the catalog when its owning app (Job Board, Field Service, Drive, eSignature, etc.) is licensed for your business. So licensing lives with the app; the on/off switch lives here.

Two business-wide settings for the shared OTP / magic-link recovery layer: (1) the rate-limit window and max attempts per identifier; and (2) how long recovery audit events are retained. Whether a given portal uses a magic-link or an OTP code is fixed in that portal's own code, not a Portals setting. Both settings apply to every portal that opts into the PortalIdentityRecovery concern.

Every recovery event (requested, sent, failed, rate-limited, consumed, invalid-token) is logged with a timestamp, IP, user-agent, and a SHA-256 hash of the identifier — never plaintext email or phone. Retention is configurable (default 180 days) and enforced by an automatic pruning job, and you can export filtered results to CSV (up to 10,000 rows). For SOC 2 / HIPAA-style reviews this is generally sufficient; check specifics with your compliance team.

Yes. Set a business-wide logo, favicon, background image, colors, Google fonts, header/footer text, and even custom CSS or header/footer HTML — changes apply immediately to every branded portal, with version history and one-click revert. You can also map a custom domain: add the hostname, publish the verification token as a DNS TXT record, and verify ownership self-serve. Issuing the TLS certificate and wiring the edge is handled by ops.

Traffic Analytics measures visitors — page views, unique visitors, sessions, bounce rate, devices, and top pages across your public portals, in realtime and per portal. Recovery Analytics measures the login-recovery flow — nightly rollups of requested / sent / consumed / failed / rate-limited counts. One is about who's visiting; the other is about how the OTP / magic-link layer is performing.

Yes. The Portals admin agent lives in the Ask AI sidebar and answers questions like "How is portal recovery doing this week?", "Which portals are enabled?", or "Any rate-limit hits in the last 24 hours?" It's read-only and admin-gated — members never see its tools — and an admin can turn it off per business.

Probably not yet. The umbrella earns its keep once you're running several public-facing portals and want one place for cross-portal traffic, recovery telemetry, audit, branding, and domains. With a single portal, the owning app's built-in settings are usually enough.

Portals requires a license and is opt-in per tenant — an administrator enables it for your business from the Apps Marketplace. It's disabled by default until then. Contact your MangoApps administrator about enabling it for your organization.