Skip to main content

Debtor account

Beyond the quick access by link, the portal offers a persistent account: the debtor creates a login with email and password and comes back whenever they want — at /conta — to track debts, agreements, history and profile over time, without depending on a new link each time.

Two ways to sign in​

The debtor portal has, today, two paths that coexist:

  • Quick link (by token) — the one-off access, with no sign-up, described in Self-service. Great for a specific charge sent by email, SMS or WhatsApp.
  • Persistent account (email and password) — a permanent login at /conta, for the debtor who wants to come back and track their own situation over time.

Both ways show the same debt and use the same protections. The account simply removes the need for a link on each access.

How the debtor gets an account​

There are two entry points:

  • Invite from the operator — on the customer's record, your team invites the person to create the account. The invite goes to the email on file and leads to a page where the debtor sets the password and activates the account.
  • From the portal itself via link — whoever opens a link and confirms identity (the last 4 digits of the document) sees a banner offering to create the account. If the person already has an email on file, the invite is created for that address; if not, they provide an email and the activation link goes there. Someone who already has an account sees, instead, an invitation to sign in.

A person marked as a third party (who used "not me") or removed can never have an account.

:::note Requires a configured email provider (SMTP) The debtor account emails — invitation/activation, magic link, password reset and email-change confirmation — depend on a transactional email provider (SMTP) provisioned in the environment. Without it, these links are generated but not sent by email; in practice the feature is unavailable until SMTP is configured. :::

What the account offers​

After signing in at /conta, the debtor finds:

  • Charges — the open debts, with updated amounts, due dates and payment buttons (boleto and Pix).
  • Agreements — the active agreements, with installment progress.
  • History — the record of interactions over time.
  • Profile — managing their own account: change the password and change the email (the email change is only confirmed through a link sent to the new address).

Account security​

The persistent account was designed with the same rigor as the rest of the portal:

  • Password stored with a strong hash (bcrypt); invite, reset and magic link tokens are stored only as a hash.
  • Its own session, in a protected cookie, separate from the panel session and the link access, with expiration by inactivity.
  • Temporary lockout after several failed login attempts.
  • Password reset by a short-lived link, and magic link to sign in without a password when needed.

Just as with the link access, everything is recorded in the portal's access trail.