Partner access
How external partners connect to Portlane — token-based webhook access, signed payloads, and onboarding from the Control Tower
Portlane keeps the whole platform private by default. When external partners need to push data in, you expose one surface only — the webhook entry point — and manage their credentials entirely from the Control Tower console. No server access, no command line, no restart.
The exposure model
Everything binds to loopback out of the box. Two surfaces can be opened deliberately, each through its own clean path:
| Surface | How it is exposed | Protection |
|---|---|---|
| Webhook ingress (partners) | A dedicated bind address for the API gateway alone, or the built-in TLS proxy | Bearer token + payload signature + rate limiting |
| Control Tower console (operators) | The built-in TLS reverse proxy (automatic certificates, only ports 80/443 open) | HTTP Basic with enforced strong credentials |
Databases, engines, and observability never leave the internal network.
How a partner call is verified
Every inbound webhook passes two independent checks before it is accepted:
- Who is calling — a Bearer token (JWT) issued per partner, with an expiry you choose. Revoking or renewing a partner never touches the server: a new partner just means a new token.
- Is the payload authentic — an HMAC signature computed with a secret unique to each source. The platform recomputes the signature and rejects anything that does not match, so a leaked URL alone is useless.
Rate limiting sits in front of both, so an abusive client is throttled before it reaches your flows.
Onboarding from the Control Tower
The console's Access section handles the full partner lifecycle:
- Issue a partner token — pick a name and a validity period, get the token immediately.
- Create or rotate a signing secret per source — the secret is generated server-side and displayed once; afterwards only its existence and age are visible, never its value.
- Changes apply live — the ingress engine picks up new or rotated secrets within seconds, without a restart or deployment.
All of it is operator-gated and audited, and none of it requires touching configuration files on the server.