Overview

In the customer portal your customers see their invoices, subscriptions and payment data – exactly what nobody else should see. To secure it there are passkeys (sign-in with fingerprint, face recognition or device PIN) and two-factor authentication via an app. You set the framework as the provider; whether a customer uses them is their decision – unless you make 2FA mandatory.

What your customers can set up

• Passkey – the customer signs in with whatever already protects their device. There is no password that could be guessed or phished. Several passkeys per customer are possible, for laptop and phone for instance.
• Two-factor authentication – a code from an authenticator app on top of the password. On setup the customer receives recovery codes; they are the lifeline if the phone is lost. Each code works only once.

Both live in the portal under "Security", where the customer can enable and remove them at any time.

What you configure

Under Settings → Customer portal → Security there are four levers. Only the account owner may change them.

• Allow passkey sign-in. When off, the portal hides the passkey buttons and blocks new registrations; passkeys already stored remain.
• Require 2FA for customers. Customers without 2FA then see a notice in the portal for 30 days; after that, access without 2FA is blocked. The 2FA offer itself cannot be switched off.
• Magic-link skips 2FA. This decides whether a sign-in link sent by email replaces the second factor. For pure B2C offerings that is convenient; where sensitive data sits in the portal, leave it off – otherwise access to the customer's mailbox is enough.
• Automatic logout on inactivity. Signs customers out after a period without activity. The limit applies to all your customers and is additionally enforced server-side – an open laptop in an office is then not a permanently open portal.

A sensible setup is to allow passkeys and leave the choice to your customers: passkeys are more convenient, an authenticator app works on every device.

Looking into a customer's portal

When a customer asks why they cannot find an invoice, a look at their exact view helps. The customer detail page offers "Log in to customer portal" for that. The button opens the portal in a new tab, signed in as that customer.

• The session lasts 48 hours; the hint on the button states that limit before you even click.
• It requires the customer to have portal access set up. Without it, Kyvento refuses the request.
• Your own Kyvento session is unaffected, and signing out in the portal tab does not affect the session your customer has on their own device.
• Every use is logged – with your user identifier and the customer concerned.
• The function requires a personal sign-in; it is not available via API tokens.

Treat the access for what it is: a look into a third party's data. Use it for the specific occasion, not as a permanent entry point.

The security reset

For two emergencies – a customer is locked out, or an account appears compromised – there is one operation. It clears the portal access completely: two-factor authentication is disabled, all stored passkeys are deleted, all signed-in devices are logged out and any outstanding sign-in links are invalidated.

That is deliberate and not excessive: whoever triggers the reset does so because the access may be in someone else's hands. If a passkey or an already-sent login link survived, the reset would invalidate everything except the very route the attacker came in through.

The customer then sets everything up again – passkey and second factor are gone, not just one of them. Tell them so, otherwise they face a portal that suddenly does not recognise them.

How to trigger it

There is no button for this in the interface yet. The operation can be triggered from a signed-in session via the API (POST /api/v1/customers/{id}/reset-2fa); Kyvento asks for your password again. The endpoint is deliberately not reachable with API tokens. If you would rather not take that route, contact our support – we trigger the reset.

Have ready which customer it concerns and why. And check who you are talking to first: a reset removes every layer of protection at once – which is exactly the lever an outsider is looking for. A callback to the number on file is the simplest safeguard. Every reset is logged and stays traceable.

Good to know

• Passkeys are bound to the device they were created on – or to the customer's password manager if they sync them there.
• Anyone who has used up all their recovery codes should generate new ones in the portal before they need them.
• These settings concern the customer portal only. Securing your own Kyvento access is covered in Enabling two-factor authentication.

Next steps

• Secure your own access – see Enabling two-factor authentication