skills.rest
twillcocks
twillcocksCOMMUNITY
Explore all skills by this author →
Website𝕏@TobyWillcocksGitHub

portal-share

Generate HMAC-SHA256 signed share links for hosted client portals.

Updated Apr 6, 2026
Search Tags:#security#credentials#tokens#portal#share#sign#auth-secret
One-click install
npx skills add https://github.com/twillcocks/showpane --skill portal-share
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: portal-share
Source: https://github.com/twillcocks/showpane/tree/main/skills/portal-share
Command: npx skills add https://github.com/twillcocks/showpane --skill portal-share

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Generates signed, password-free share links to hosted client portals, enabling secure external access without login and revoking access when credentials rotate.

Core Features & Use Cases

  • Signed share tokens built from portal slug, scope, and credential version using HMAC-SHA256, embedded in a full URL built from NEXT_PUBLIC_APP_URL.
  • Post-publish sharing: provide clients or stakeholders with quick access without creating accounts; revoke by rotating credentials or deactivating the portal.
  • Security-first workflow: tokens tie to credential version and require AUTH_SECRET; supports per-portal scoping and revocation.

Quick Start

Publish the portal and then generate a share link to share with the client.

Frequently Asked Questions about portal-share

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate secure share links for a client portal without requiring login credentials?▼

You can generate secure share links by signing an HMAC-SHA256 token using your AUTH_SECRET, which embeds the portal slug and credential version into a URL built from NEXT_PUBLIC_APP_URL for password-free access.

How does token revocation work for shared portal links?▼

Token revocation works by tying the signed token to a credential version, meaning access is automatically revoked whenever credentials rotate or the portal is deactivated, invalidating old share links.

Do I need an AUTH_SECRET environment variable to create signed portal URLs?▼

Yes, you need an AUTH_SECRET environment variable to sign the HMAC-SHA256 tokens, and NEXT_PUBLIC_APP_URL must be configured to build the full shareable URL for the hosted client portal.

What is the best way to provide external stakeholders access to a published portal?▼

The best way is to publish the portal and then generate a signed, password-free share link, allowing external clients and stakeholders quick access without needing to create user accounts.

Can I scope share tokens to a specific hosted client portal?▼

Yes, the signed tokens support per-portal scoping by including the specific portal slug in the HMAC-SHA256 token payload, ensuring the share link is tied to that exact portal.

What are the limitations of using signed tokens for portal access?▼

A limitation is that share links become invalid when credentials rotate or the portal is deactivated, requiring you to generate new signed URLs to restore client and stakeholder access.

Related Skills

Explore More Content & Communication Skills→
lancedblancedb
11.1k

lancedb-connect

Derive LanceDB REST base URL and authentication headers from inputs.

Official
Intermediate
cosmixcosmix
53

auth

Implement authentication and authorization with OAuth2, JWT, and RBAC/ABAC.

Community
Advanced
ki2pixelki2pixel

magic-link-auth-companion

Manage magic-link authentication with HMAC-SHA256 signing and token revocation.

Community
Advanced
JustineDevsJustineDevs

authentication-setup

Implement secure authentication and RBAC authorization for web APIs, mobile apps, and enterprise portals using JWT and OAuth.

Community
Advanced