Donor portal
Explain token-based donor access, recurring self-service, and receipt downloads.
Donor portal
The donor portal is a public, token-protected page at /donations/portal. It lets a donor review their donations to one organization without creating an administrator account.
Request access
- Open the organization’s
/donations/portalpage. - Enter the email address used for the donation.
- Request an access link.
- Open the link delivered by email.
The request endpoint does not reveal whether an email has a matching donation. A portal link is time-limited. If it expires, request a new link rather than forwarding an old token.
The success page after a donation can also provide a portal access route. The mobile app can use the same token flow through its donation portal experience.
What the portal shows
The portal separates:
- Recurring donations with amount, interval, project, status, start date, and controls.
- One-time transactions with amount, project, date, and status.
- Receipt-year selection and PDF download when the organization issues receipts and eligible years exist.
The donor can switch the portal language from the language control.
Recurring self-service
For an active recurring donation that is not already ending, the donor can:
- Update the payment method through the provider billing portal
- Change the recurring amount, with a minimum of €1.00
- Pause collection
- Resume a paused donation
- Cancel at the end of the current period
The portal validates that the token, donor email, organization, and subscription belong together before changing the subscription. Changing the amount creates a new recurring price without proration in the current implementation.
Failed or expired links
- An invalid or expired token shows an access error and a route back to the donation page.
- A donor who no longer has a matching donation may not receive a new access link.
- A failed recurring payment shows a payment-update notice. Use the provider billing portal to update the payment method or settle an open invoice.
Treat portal links like passwords. Do not publish them in a campaign, screenshot, QR poster, or support ticket.