Your helpdesk has two sides: the knowledge base and FAQ, which anyone can read, and the ticket area, where clients sign in to create and track their requests. Chatonio gives you three sign-in methods — magic link, email + password, or SSO from your own app — plus a switch that controls who can create an account at all.
Everything described here lives in Admin → Projects → [Your Project] → Knowledge Base → Settings, in the Helpdesk access section. The helpdesk portal itself is available on the Pro and Ultimate plans — see Setting Up Your Helpdesk if you haven't created one yet.
Magic link (the default)
The passwordless default. A client types their email on the login page and receives a one-time sign-in link. Clicking it signs them in — no password to invent, remember, or reset.
- Each link works once and expires after 15 minutes.
- Nothing to configure — it works out of the box.
- Best for clients who visit occasionally: they can never be stuck on a forgotten password.
Email and password
Classic login for clients who visit often and expect a password form. Select Email and password as the authentication method.
- The first login still goes through a magic link: it verifies the client's email, then asks them to set a password.
- After that, they sign in with email + password. The email-link option stays available as the "forgot password" and first-time-login path.
SSO — sign in from your own app
If your clients already have accounts in your product, SSO removes the second login entirely: a user clicks "Support" in your app and lands in the helpdesk already signed in. At a high level:
- In Helpdesk access, open the SSO/JWT bridge section and click Generate secret. Copy it right away — it is shown exactly once.
- Your backend uses that secret to sign a short-lived token (valid for 5 minutes, single use) carrying the user's ID, email, and name. The exact token format and redirect URL are shown in the developer notes next to the secret.
- Your app redirects the user to the helpdesk with that token — they arrive already authenticated.
Good to know:
- While SSO is the active method, the public magic-link and password forms are hidden — the login page tells visitors to sign in through your app instead. You can also set an optional logout redirect back to your site.
- Rotate secret invalidates the old secret immediately — update your backend at the same time.
- You can't switch the authentication method to SSO until a secret exists, and Disable SSO automatically reverts the helpdesk to magic-link login — so clients are never locked out by a misconfiguration.
Open vs invite-only registration
Independent of the sign-in method, the Registration setting decides who can get an account:
- Open (default) — any visitor can create an account from the login page.
- Invite only — self-registration is off. Existing clients keep signing in as usual, but unknown email addresses don't get an account; new accounts come only from your team. This also applies under SSO: a valid token from your app is not enough for a user you haven't provisioned yet.
Creating client accounts yourself
Operators can provision helpdesk accounts directly — the only way in for new clients on an invite-only helpdesk, and available in every mode:
- Open the Contacts page and click Add client.
- Choose the Portal client type and enter the client's email (and, optionally, a display name).
- Click Create & send invite — the client receives a welcome email with a sign-in link.
Accounts created this way are treated as verified. On a password-mode helpdesk the invited client is asked to set a password on first login; on a magic-link helpdesk the link signs them straight in.
Which should you choose?
- Magic link — the safe default for a general audience and occasional visitors. Zero setup, zero password resets.
- Email and password — for clients who come back frequently and prefer a classic login form.
- SSO — when the helpdesk serves your own product's users: one account, no second login, and your app stays in control of who gets in.
- Add invite only in any mode when the helpdesk is for a closed client base — B2B customers, paying accounts, internal teams.
Want the portal on your own domain as well? See Use your own domain for the helpdesk.