> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adoraone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Portal — Security

> Configure portal access, feature flags, directory privacy, and registration links.

**Portal security** is managed from **Settings → Portal** — enable the portal, choose which modules members can use, control directory visibility fields, and distribute the visitor registration link.

<Frame>
  <img src="https://mintcdn.com/adoraplan-b5f8a5a4/Q7eIYf4z4qB2WPTX/images/portal/portal-settings.png?fit=max&auto=format&n=Q7eIYf4z4qB2WPTX&q=85&s=f4d6e59a10657cb998a7bc68e7d43da4" alt="Settings Portal tab with enable toggle, feature switches, and registration URL" width="1440" height="900" data-path="images/portal/portal-settings.png" />
</Frame>

## Quick Start

1. Open **Settings → Portal** (admin or moderator role required).
2. Turn on **Enable member portal** for your tenant.
3. Toggle individual features: Family, Events, Serving, Prayer, Directory.
4. Choose which fields appear in the member directory.
5. Copy the **Registration URL** and share it securely with guests.

***

## How-to Guide

### Access tokens

| Topic          | Guidance                                                    |
| -------------- | ----------------------------------------------------------- |
| **Format**     | Opaque UUID stored in `member_portal_tokens`                |
| **Lifetime**   | 90 days from issuance                                       |
| **Delivery**   | Email link after registration approval, or admin-generated  |
| **Revocation** | Expired tokens fail validation; issue a new link            |
| **Storage**    | Browser `sessionStorage` — closing the tab ends the session |

There is no separate `/portal/security` page — members manage only their own **Profile** visibility (`show in directory`).

### Feature flags

Disable modules you are not ready to expose:

* **Family Management** — household read-only view
* **Event Registration** — attendance sign-up
* **Serving Schedule** — roster visibility
* **Prayer Requests** — submission form
* **Members Directory** — opt-in directory + prayer wall

Disabled features hide navigation items even if the token is valid.

### Directory privacy

Under **Directory fields**, choose what opted-in members may see about each other:

* Phone, email, address, member-since date

Members control participation with **Show in directory** on their portal profile. Staff should train members before enabling sensitive fields.

### Registration link safety

* The public URL includes only the church **short name** slug — not a secret.
* Email OTP verification prevents spam registrations.
* Admins must **approve** before a token is issued.

<Tip>
  Platform admins configure church **short name** in **Organization** — required for `/portal/register/{slug}` links to resolve correctly.
</Tip>

***

## Related

<CardGroup cols={2}>
  <Card title="Member Portal" icon="id-card" href="/en/adoracare/portal-overview">
    End-user portal experience after login.
  </Card>

  <Card title="Visitor Registration" icon="user-check" href="/en/adoracare/visitor-registration">
    Public form that feeds approval workflow.
  </Card>

  <Card title="Settings" icon="sliders-horizontal" href="/en/adoraplan/settings">
    Other tenant configuration (branding, programs, etc.).
  </Card>
</CardGroup>