Portal Access

Guests access the Guest Portal through a personalized link that authenticates them and connects them to their booking. hejGuide supports two authentication methods: automatic magic links and manual date-based login. Both methods are secure and require no password or account creation from the guest.

Magic links

Magic links are the primary and recommended way for guests to access the portal. When a guest receives an email containing the {guidebook_link} template variable, the link includes a unique access token that logs them in automatically.

How magic links work

1. You send the guest an email (manually or via Automated Emails) that includes {guidebook_link}.
2. hejGuide generates a secure token for that booking, stored in the guest_portal_access table, and builds a link to the magic-link entry route.
3. The guest taps the link in their email.
4. The entry route validates the token, identifies the booking, issues a session cookie, and redirects the guest into the portal (or the guidebook) with full access.

No login form, no password, no friction. The guest taps one link and they are in.

Magic link entry route

The magic link points at the portal entry route, which carries the token as a query parameter:

https://guide.hejguide.com/api/auth/portal?token={token}

It typically includes a next parameter so the guest lands on the right guidebook page after authenticating.

Each token is:

• Reusable -- The same token works for the whole stay; opening it does not consume it.
• Hard to guess -- A cryptographically random token unique to the booking.
• Stored securely -- Tokens are saved in the guest_portal_access table and validated on each use, with a sliding expiry (see below).

When to use magic links

Use the {guidebook_link} variable in your automated email templates. The most common setup is to include it in a pre-arrival email sent 2-3 days before check-in:

Hi {guest_first_name},

Your guidebook for {property_name} is ready:

{guidebook_link}

It includes everything you need -- property details, house rules,
local recommendations, and your booking information.

See you soon!
{host_name}

You can also include {guidebook_link} in a booking confirmation email, a check-in reminder, or any other automated or manual message.

TIP

The magic link grants access to the full Guest Portal -- booking details, messaging, products, invoice, and check-in. You do not need separate links for each feature. One link does everything.

Date-based login

If a guest cannot find their magic link email or accesses the guidebook URL directly (without a token), they can log in manually using the date-based login form.

How date-based login works

1. The guest opens the guidebook URL without a token (e.g., guide.hejguide.com/beach-house/).
2. They see the public guidebook content but not the portal sections (booking, chat, products, invoice).
3. They tap "Log in" or navigate to the booking section.
4. A login form asks for two pieces of information:
   • Check-in date -- The first night of their stay
   • Last name -- The surname on the booking
5. hejGuide matches the check-in date against bookings for that guidebook's listing, then checks the last name. The last-name match is fuzzy -- it is case-insensitive and ignores common prefixes such as "van", "van der", "de", or "von".
6. If a match is found, the guest is logged in and gets full portal access.

Why these two fields?

The combination of check-in date and last name is enough to identify a specific booking without requiring a password. It is information the guest already knows (from their booking confirmation), making it easy to use. To keep it secure, hejGuide rate-limits attempts and temporarily locks a booking after repeated failed last-name guesses, steering the guest toward the magic link instead.

WARNING

If two bookings for the same listing share the same check-in date and a matching last name (rare), the system logs the guest into the matched booking. In practice this almost never occurs.

Portal session

Once authenticated (by either method), the guest receives a session cookie:

Setting	Value
Cookie name	hejguide-guest-session
Secure flag	Yes (HTTPS only, in production)
HttpOnly flag	Yes (not accessible via JavaScript)
SameSite	Lax

The guest can close their browser and return to the guidebook URL later without logging in again, as long as the session cookie is still valid.

Post-checkout access

Magic-link access uses a sliding 30-day window. Each time the guest opens their personalized link, hejGuide pushes the expiry forward another 30 days. As long as they keep using the link, access stays alive well past checkout, which lets them:

• Download their invoice for expense reporting.
• Review messages exchanged during their stay.
• Access property information they may have saved or bookmarked.

If the link goes unused for 30 days, it expires and the portal sections are no longer accessible. The public guidebook content remains available, and you can always resend a fresh link.

What guests see before and after login

Content	Without login	With login
Guidebook pages	Visible	Visible
Local Guide (Nearby)	Visible	Visible
Emergency contacts	Visible	Visible
Booking details	Hidden	Visible
Chat / Messages	Hidden	Visible
Products & Services	Hidden	Visible
Invoice	Hidden	Visible
Check-in form	Via separate check-in link	Accessible from portal

Security considerations

• Magic link tokens are cryptographically random and unique to each booking, making brute-force attacks impractical.
• Tokens are single-booking -- each token maps to exactly one booking. A guest cannot use their token to see another guest's booking.
• No passwords -- Guests never create an account or set a password, eliminating the risk of weak or reused passwords.
• HTTPS only -- All portal traffic is encrypted. Session cookies are marked Secure and HttpOnly.
• Sliding expiry -- Magic-link access expires after 30 days without use; each use renews the window. Date-based login is rate-limited and locks out after repeated failed attempts.

Troubleshooting

Guest says "I can't access my booking"

1. Check if the booking is linked to the guidebook -- The booking's listing must have a guidebook assigned. If no guidebook is linked, the portal has nowhere to show.
2. Resend the magic link -- Open the booking in hejGuide and resend the guidebook email, or copy the portal link and send it manually.
3. Suggest date-based login -- Tell the guest to open the guidebook URL and use the login form with their check-in date and last name.

Guest logged out unexpectedly

• If the guest clears their browser cookies or switches devices, they need to log in again.
• Send a fresh magic link or have them use the date-based login.

Magic link not working

• Ensure the email template uses {guidebook_link} (with curly braces, not square brackets or double curly braces).
• Check that the booking's listing has a published guidebook assigned.
• Verify the guidebook is published (not in draft).

Related

• Guest Portal Overview -- What the Guest Portal includes
• Booking View -- What guests see about their booking
• Publishing Your Guidebook -- Make the portal accessible
• Automated Emails -- Send magic links automatically
• Template Variables -- Use {guidebook_link} in templates