Everything you prepare for a client now lives in one place: verityagentic.ai/clients. A client goes there, proves who she is once, and that browser remembers her from then on.

This page is the plain-English version. It exists because the first explanation was confusing, and because you will want to reread this in three months when you have forgotten every detail.

What a client does

1. She goes to verityagentic.ai/clients and types her email address.
2. She gets an email with a short code, something like KRM7-P2XQ.
3. She types the code in, and she is looking at her reports.

That is it. No password to choose, no account to create, nothing to remember. The next time she visits on that same laptop or phone, she goes straight in without being asked anything.

If she opens it on a different device, she does step one and two again on that device. A browser can only remember her on the machine she used.

Why a code instead of a link

This is the part worth understanding, because the obvious design is a link and the obvious design is wrong here.

If the email contained a click-to-open link, it would work perfectly for most people and fail badly for exactly the clients you have. Medical practices, law firms and anyone with corporate email run security software that opens every link in every incoming email to check it for malware. That software would open the sign-in link before your client ever saw the message, using it up. She would click it, and be told her link was no longer valid, having done nothing wrong.

Slack hit this problem and switched to typed codes for the same reason. A machine that never types a code cannot use one up.

Is a short code safe?

Yes, and the reason is not its length.

Eight characters gives about 850 billion combinations, which sounds like a lot but is not, on its own, the thing protecting anything. What protects it is that ten wrong guesses kill the code. Nobody gets to keep guessing. That is the rule the US government's own standards body sets for short codes: rate limit them, and even a six-digit code is considered sound.

The code also expires in 15 minutes and works only once.

There are no special characters in it, and no I, L, O, 0 or 1. Those get misread and misheard, and someone is going to read one of these aloud over the phone one day. Capitals do not matter, and neither does the hyphen.

What you do

To let a new client in, send them an invitation. It is a link, and it is safe as a link, because opening it does not use anything up. Your client opens it, types whatever email address suits her, and she is in. You get an email telling you which address she chose, so you never have to guess in advance.

py -3.13 scripts/invite_client.py evermore

To see who can open what, ask.

py -3.13 scripts/invite_client.py --list

If a client types an address you do not have on file, she gets a polite "check your email" and nothing arrives, which is deliberate. That message never confirms or denies whether an address is real, because otherwise the form becomes a way for a stranger to find out who your clients are. You, however, get an email telling you exactly what she typed, so you can add it in seconds.

What this replaced

Until 4 August, every client report was a file on the website with one shared password, cookiemonster, printed inside the page itself. The check ran in the reader's own browser.

That meant anyone holding the address of a report could read it without knowing the password at all, just by viewing the page source. Laura's revenue figures and Evermore's numbers were both sitting behind a lock that opened itself if you looked at it.

They are now stored in a database and only sent to a browser after the server has checked who is asking. The old password is dead everywhere.

Some details that matter later

Still open

Two things are not finished, and you should know about them rather than discover them.

The PDFs are not behind the gate yet. The report PDFs at verityagentic.ai/clients/files are protected only by having an address nobody could guess. That is weaker than the web reports, and closing it means moving them the same way the web reports moved.

The reports themselves are the old ones. What is behind the gate today is exactly what was there before, in the old page style. The Verity report styling and the emailed Typst PDF from the delivery plan are still to come.