# How to configure staff access to Client Portal

For **root administrators**: allow employees of **your organization** (operators, supervisors) to open end-user ticket links in **read-only** mode with internal context.

## When you'll need this

- Staff receive Support Portal ticket links from end users and need the portal-user view plus internal notes.
- You need a **read-only ticket list** in the portal with Organization / Client filters — without create or edit.
- You are preparing the instance for a Client Portal update with the staff-view UI.

## What's important to know

- You need the separate **Client Portal (staff)** permission — not the **Client Portal** reporter marker.
- Non-root users need all of: **Client Portal (staff)**, **Operator Panel** (route), and **Tickets** (entity).
- **root** opens Client Portal in staff mode by default and does not need these role permissions.
- Users with the full staff set **can** sign in to Constructor; portal-only reporters **cannot**.
- Links to an external tracker (for example, Jira) are built only from the instance **trusted** base URL, not from arbitrary text in the ticket field.

## Before you start

- [x] You are signed in as **root**.
- [x] Client Portal is deployed and `client_portal_url` is set (see [administrator hub](../admin-hub.md)).

## Step-by-step

### 1. Role for staff

1. Open **Settings → Users → Roles**.
2. Create or edit a role (for example, for your support line).
3. Enable **Client Portal (staff)**.
4. Enable **Operator Panel** (route) and **ticket entity** view rights.
5. Do **not** enable the **Client Portal** reporter marker on the same role if it is for your organization’s staff.
6. Save the role and assign it to the right users.

→ Module details: [Configure roles](../../settings/how-to/configure-roles.md)

### 2. Trusted URLs for context

Under **Settings → Instance settings**, create or update keys (values as `https://…` without query strings):

| Key | Purpose | Example |
| --- | --- | --- |
| `client_portal_staff_jira_url` | Tracker base (no `/browse/KEY`) | `https://tracker.example.com` |
| `client_portal_staff_operator_line_url` | Constructor base for chat deep link | `https://app.example.com` |
| `client_portal_staff_recent_ticket_days` | Window for “recent tickets” (1–90) | `7` |
| `client_portal_staff_highlighted_client_field_keys` | JSON array of highlighted client field keys | `["instance_url"]` |

→ General instance keys: [Configure instance settings](../../settings/how-to/configure-instance.md)

### 3. Verify

1. Sign in to Constructor as a user with the new role — access should work.
2. After the Client Portal update, open a direct ticket link — staff-view should appear (read-only, internal notes, context panel).
3. A **Client Portal only** reporter still cannot sign in to Constructor.
4. On the tickets screen, staff sees direct-link entry by default; **Show ticket list** opens a read-only list (use **Organization** / **Client** filters if needed). Return via **Direct-link view**.

## Related

- [Staff view in Client Portal](../explanation/staff-view-in-portal.md)
- [Administrator hub](../admin-hub.md)