Client Portal Magic Link OTP Fallback for Expired Links

TL;DR

Expired Client Portal magic links now automatically redirect contacts to OTP verification for access.

This is a small update to Client Portal security handling. No immediate action is required from agencies.

Who this affects

Go HighLevel has not confirmed who this update affects. It pertains to users of the Client Portal feature.

This update does not affect agencies not utilizing the Client Portal.

What changed

HighLevel has introduced an OTP fallback mechanism for expired Client Portal magic links. The specifics are:

• Expired Client Portal magic links now automatically redirect to the OTP verification screen.
• An OTP is automatically sent to the contact’s email address.
• The contact’s email address is masked on the OTP verification screen.

HighLevel has not confirmed if this replaces or breaks existing functionality. Limits or plan gating for this feature are currently unknown. The rollout status for this feature is also unknown.

Where to find it

HighLevel has not published the exact location for this feature. As it is an automatic fallback for expired magic links, it likely functions as a background process within the Client Portal login flow itself, rather than having specific settings or controls within the HighLevel platform interface.

How agencies will use this

Agencies utilizing the Client Portal will find this improves the user experience for their clients. For example, a client who frequently accesses their client portal may bookmark an old magic link. If that link expires, instead of seeing an error or being forced to request a new link manually, they will now be seamlessly redirected to a page where a one-time password can be sent to their email. The client then enters this OTP, gaining immediate access to their portal. This reduces friction and support requests for expired access links, particularly for clients who do not log in frequently or who rely on older email invitations.

Our take

This is a standard significance update. HighLevel has not provided a specific reason for its significance, but it is a minor enhancement to the Client Portal's login flow. It addresses a specific point of friction for clients attempting to access their portal with an expired magic link. Agencies should be aware of this change, but it is unlikely to require any immediate action or significant adjustment to current operations. This is not an update that warrants re-strategizing or major client communication.