Building a client portal: logins, permissions and what it costs

en 2026-09-16 6 min read

A client portal on a new site is step 04 work, EUR 3.500-7.500, built over 6-12 weeks. If it also needs client organisations with their own users, billing inside it and an admin console for your staff, it is step 05, a custom platform from EUR 7.500, quoted after discovery.

A website shows the same page to everyone. A portal has to answer a different question before it renders anything: who is asking, and what are they allowed to see. That question turns a site into an application, and the price follows from it.

The line where a website becomes an application

You cross it the moment a page depends on the person looking at it. A price list is a website. A price list that shows your client their agreed rate is an application. The design may barely change, while underneath you now need accounts, sessions, permission checks and a data model that knows who owns each row.

That is why a portal on a new site is quoted as step 04 rather than as extra pages on a step 03 business website. Step 03 at EUR 1.500-3.500 covers 4-7 pages, a CMS, service pages and a contact or booking flow. None of those need to know who you are. Every step and its range is listed on packages.

What sits behind the number

A portal is made of six pieces of work, and the quote moves with each of them.

• Authentication. Sign in, sign out, password reset, invitations for new users, and a second factor if the data deserves one. We use a proven provider rather than hand-written password handling.
• Permissions. What each kind of user may see and change, enforced on the server, not by hiding buttons.
• The data model. Which records belong to which client, and what happens to them when a person leaves or an account closes.
• The screens. Every one needs its loading state, its empty state and its error state, not only the happy path.
• Files. Uploads, downloads, size limits, and making sure a document link cannot be guessed or shared out of the portal by accident.
• The staff side. Someone in your team has to create accounts, fix a wrong upload and see what a client sees. That admin area is real work, so check that any quote you compare includes it.

Which step a portal belongs to on a new site

The line between the last two rows is the difference between a portal and a platform, so settle it before anyone designs a screen.

Permissions are the part that is quietly expensive

Every screen in a portal has to answer three questions, and answer them on the server, where whoever is looking cannot edit the answer.

1. Who is signed in right now.
2. Which records this person has any right to see.
3. Which of those records this person may change, and which are read-only for them.

Hiding a button is not an answer to any of the three. If a client can reach a document by changing a number in the address bar, the button was the only thing protecting it. Writing the check once, in a place every query has to pass through, is what keeps the portal correct as screens are added later. It is also why a portal with two roles is a different quote from a portal with five.

Draw the role grid before the screens. Put every role down the side, every thing they might do across the top, and fill in the boxes. Disagreements about who may see what then surface before anything is built, which is the cheapest moment to settle them.

Your data, your database

You own the code, the repository and the database. That matters more for a portal than for a brochure site, because the portal accumulates your clients' documents, messages and history, and that has to be yours to move, export and back up. Hosting is agreed per project, as part of the scope.

Two practical consequences. Exports should exist from the start, so the data is never trapped inside the interface. And backups are part of Care at EUR 100-300 a month, alongside updates, monitoring and small fixes, which is upkeep rather than new features.

How the work runs

1. Scoping. Roles, the permission grid, the data model, and what the portal replaces. A fixed quote follows this.
2. The data model and authentication, built first because everything else leans on them.
3. One screen end to end, real data, real permissions, so you can use it and react to it early.
4. The remaining client screens, each with its empty, loading and error states.
5. The staff and admin side, including creating accounts and correcting mistakes.
6. Testing with a real client account, then launch.

Step 04 runs 6-12 weeks; for step 05 the timeline comes out of discovery. The part that waits on you is the permission grid and sample content that resembles the real thing. Our design and engineering page covers how the build itself is run, and the Next.js development page covers the stack we use for signed-in work.

When to spend less

A portal is worth building when the same information is requested from you again and again. Until then, cheaper answers hold up.

• One document per client per period is an email. An email already goes to the right person and costs nothing to send.
• A shared folder with per-client access does file sharing properly, and it is somebody else's job to keep it running.
• If clients mainly want to book an appointment, a step 03 business website with a booking flow at EUR 1.500-3.500 does that without a single account.
• If only your own team needs to look information up, a well-organised CMS with restricted editor access may already do it, and your clients never need an account.

Questions buyers ask

Can the portal live inside our current website?

Yes, as the dashboard or client login add-on at EUR 1.500-4.000, with the quote confirming the scope. The portal is added as a signed-in area of the same site, sharing the design, the domain and the components, while the public pages stay as they are. That keeps one login, one deploy and one place to look when something breaks.

What makes a portal go from step 04 to step 05?

Three things: client organisations where several users share one account's data, billing that runs inside the product, and an admin console that your team operates as a tool in its own right. Each one adds roles, states and edge cases. At that point it is a platform from EUR 7.500, scoped in discovery.

Is a portal covered by Care?

Running it is. Care at EUR 100-300 a month covers updates, monitoring, backups and small fixes, which for a portal means dependency and security updates, watching for errors and repairing small breakages. New screens, new roles and new integrations are new work with their own quote.

How do you handle security?

Authentication through a proven provider, permission checks on the server, and least access by default, so a new screen is closed until it is deliberately opened. Security is a property of the data model and the checks around it, so it is designed in from the start rather than added at the end.

Can we start with one feature and grow?

Yes. Authentication and the data model are built once and carry everything after them, so the first release can be a single screen that does one job. Each addition is then scoped and quoted on its own, decided with a portal your clients already use.

Use the contact form to send us the three questions your clients keep asking, and we will tell you whether the answer is a portal or an email.