portal-share

Generate HMAC-SHA256 signed share links for hosted client portals.

Updated Apr 6, 2026

Search Tags:#security #credentials #tokens #portal #share #sign #auth-secret

Ready to run

npx skills add https://github.com/twillcocks/showpane --skill portal-share

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: portal-share
Source: https://github.com/twillcocks/showpane/tree/main/skills/portal-share
Command: npx skills add https://github.com/twillcocks/showpane --skill portal-share

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Generates signed, password-free share links to hosted client portals, enabling secure external access without login and revoking access when credentials rotate.

Core Features & Use Cases

Signed share tokens built from portal slug, scope, and credential version using HMAC-SHA256, embedded in a full URL built from NEXT_PUBLIC_APP_URL.
Post-publish sharing: provide clients or stakeholders with quick access without creating accounts; revoke by rotating credentials or deactivating the portal.
Security-first workflow: tokens tie to credential version and require AUTH_SECRET; supports per-portal scoping and revocation.

Quick Start

Publish the portal and then generate a share link to share with the client.

Frequently Asked Questions about portal-share

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate secure share links for a client portal without requiring login credentials?▼

You can generate secure share links by signing an HMAC-SHA256 token using your AUTH_SECRET, which embeds the portal slug and credential version into a URL built from NEXT_PUBLIC_APP_URL for password-free access.

How does token revocation work for shared portal links?▼

Token revocation works by tying the signed token to a credential version, meaning access is automatically revoked whenever credentials rotate or the portal is deactivated, invalidating old share links.

Do I need an AUTH_SECRET environment variable to create signed portal URLs?▼

Yes, you need an AUTH_SECRET environment variable to sign the HMAC-SHA256 tokens, and NEXT_PUBLIC_APP_URL must be configured to build the full shareable URL for the hosted client portal.

What is the best way to provide external stakeholders access to a published portal?▼

The best way is to publish the portal and then generate a signed, password-free share link, allowing external clients and stakeholders quick access without needing to create user accounts.

Can I scope share tokens to a specific hosted client portal?▼

Yes, the signed tokens support per-portal scoping by including the specific portal slug in the HMAC-SHA256 token payload, ensuring the share link is tied to that exact portal.

What are the limitations of using signed tokens for portal access?▼

A limitation is that share links become invalid when credentials rotate or the portal is deactivated, requiring you to generate new signed URLs to restore client and stakeholder access.