Portal Logins Without Airtable Seats or Passwords

The usual way to give someone access to Airtable data is to add them to the base. That costs a seat per person per month, and it hands them the whole base, formulas and internal notes included.

Portal users are not Airtable users. They log in to your portal with an email address and a code, and they cost nothing.

What it does

Someone opens the portal, types their email, and receives a 6-digit code. They enter the code and they are in.

• No password to set, forget, or reset
• No Airtable account and no CollabPortals account
• No per-user fee, however many people you let in
• Access is decided by your user table: their email is in it, or they sign up if you allow that

That last point is the part that makes it manageable. The guest list is a table in your own base. Adding a client is adding a row; removing access is removing one.

Why it matters

Every alternative makes access someone's ongoing job. Sharing an Airtable view means managing link secrecy. Adding collaborators means managing seats and paying for them. A password-based portal means resetting passwords for people who log in twice a year.

Email codes remove all three. A user who has not visited since March does not need to remember anything, and you do not need to do anything.

How it works

The email address in the user table is the credential. When someone submits an email, CollabPortals looks for a matching row, and only sends a code if it finds one.

Two settings change that shape, and both are off by default. Codes off logs people in on the email address alone, which is faster and much weaker: anyone who knows an address in your user table can sign in as that person. Self-registration puts a sign-up link on the login screen, so someone not yet in the user table can create their own row, filling in the fields your default role is allowed to create on the user table. A field you allow people to edit later but not at sign-up stays off the form, as do linked-record and attachment fields, which the sign-up form does not collect.

Sessions last 7 days and are held in a signed cookie, after which the user signs in again with a fresh code. A session belongs to one portal, so signing into a second portal on the same domain replaces the first. Codes expire after a short window, and repeated failed attempts are rate limited.

The portal URL itself is not a secret and does not need to be treated as one. Anyone can open it; getting past the login screen means being in the user table, or signing up if you have turned self-registration on. The authentication guide covers the flow in full.

Who it is for

Any audience that is large, occasional, or changes often: clients, members, contractors, and event crews. The more people you need to let in, the more the per-seat alternative costs and the better this looks.