How to configure staff access to Client Portal

For root administrators: allow employees of your organization (operators, supervisors) to open end-user ticket links in read-only mode with internal context.

When you'll need this

Staff receive Support Portal ticket links from end users and need the portal-user view plus internal notes.
You need a read-only ticket list in the portal with Organization / Client filters — without create or edit.
You are preparing the instance for a Client Portal update with the staff-view UI.

What's important to know

You need the separate Client Portal (staff) permission — not the Client Portal reporter marker.
Non-root users need all of: Client Portal (staff), Operator Panel (route), and Tickets (entity).
root opens Client Portal in staff mode by default and does not need these role permissions.
Users with the full staff set can sign in to Constructor; portal-only reporters cannot.
Links to an external tracker (for example, Jira) are built only from the instance trusted base URL, not from arbitrary text in the ticket field.

Before you start

You are signed in as root.
Client Portal is deployed and client_portal_url is set (see administrator hub).

Step-by-step

1. Role for staff

Open Settings → Users → Roles.
Create or edit a role (for example, for your support line).
Enable Client Portal (staff).
Enable Operator Panel (route) and ticket entity view rights.
Do not enable the Client Portal reporter marker on the same role if it is for your organization’s staff.
Save the role and assign it to the right users.

→ Module details: Configure roles

2. Trusted URLs for context

Under Settings → Instance settings, create or update keys (values as https://… without query strings):

Key	Purpose	Example
`client_portal_staff_jira_url`	Tracker base (no `/browse/KEY`)	`https://tracker.example.com`
`client_portal_staff_operator_line_url`	Constructor base for chat deep link	`https://app.example.com`
`client_portal_staff_recent_ticket_days`	Window for “recent tickets” (1–90)	`7`
`client_portal_staff_highlighted_client_field_keys`	JSON array of highlighted client field keys	`["instance_url"]`

→ General instance keys: Configure instance settings

3. Verify

Sign in to Constructor as a user with the new role — access should work.
After the Client Portal update, open a direct ticket link — staff-view should appear (read-only, internal notes, context panel).
A Client Portal only reporter still cannot sign in to Constructor.
On the tickets screen, staff sees direct-link entry by default; Show ticket list opens a read-only list (use Organization / Client filters if needed). Return via Direct-link view.