How to white-label your client billing portal

white-label client billing portal is the topic of this guide. A white-label client billing portal is the page where your clients view invoices, update payment methods, and pay you — running on your agency's own domain and branding instead of a generic vendor URL. This guide walks through the three pieces that make it feel like your product: pointing a custom subdomain at the portal with a CNAME record, applying your logo and colors, and giving clients passwordless magic-link login. The steps below describe how this is set up in HubWho, the agency billing and client-operations platform built for how agencies actually bill recurring clients.

Why white-label the billing portal at all

When a client logs in to pay you, the URL and the branding are doing quiet trust work. A portal sitting on a generic vendor domain tells clients you're reselling someone else's tool; a portal on billing.youragency.com tells them they're dealing directly with you. For an agency that positions itself as the system of record for a client's marketing, that distinction matters at exactly the moment money changes hands.

White-labeling has three independent layers, and you can ship them in order: the domain (a custom subdomain via CNAME), the look (logo, colors, business name on invoices and the portal itself), and the login experience (magic-link instead of a password your client will forget). HubWho is built so each client gets a portal on your agency's own domain — the rest of this guide is the operator-level walkthrough.

Step 1 — Point a custom subdomain at the portal (CNAME)

Pick the subdomain your clients will see — billing.youragency.com and pay.youragency.com are the common choices. You're delegating just that one hostname, not your whole domain, so your main site and email are untouched. In your DNS provider (Cloudflare, GoDaddy, Namecheap, Route 53, etc.), create a single CNAME record: the host/name is the subdomain (billing), and the target is the portal hostname HubWho gives you for your account.

Two operator gotchas. First, if you're on Cloudflare, set that CNAME record to DNS-only (grey cloud) during setup so certificate validation isn't blocked by the proxy. Second, DNS changes are not instant — propagation typically lands within minutes but can take up to a few hours, so add the record, then come back and confirm the portal resolves over HTTPS before you send any client a link. Once the subdomain resolves, every invoice and login link your clients receive lives on your domain, not a vendor's.

Step 2 — Apply your branding

Branding is what makes the portal read as yours the moment a client opens it. Upload your logo, set your brand colors, and confirm your agency's business name is the name on the portal header and on the invoices themselves — that name is what shows on the client's card or bank statement line and in their records, so get it exactly right before the first send.

Keep the branding consistent with the domain you just configured: a portal on billing.youragency.com that still shows a stock logo undercuts the whole effect. Once your logo, colors, and business name are in place, a client moving from your website to your billing portal shouldn't feel a seam — same name, same look, same domain family.

• Logo and accent color applied across the portal and every outbound email
• Theme choice of dark, light, or system-default, driven by CSS variables so it follows each client's OS preference
• Custom email templates for invoices, quotes, and reminders, edited with your own HTML and placeholder variables
• Sender domain set to your own address so the whole paper trail reads as your agency

Step 3 — Turn on magic-link login

Passwords are friction at the worst possible moment: a client wants to pay or update a card, hits a forgotten password, and the payment stalls. Magic-link login removes that. The client enters their email, receives a one-time sign-in link, and clicks through straight into their portal — no password to set, store, or reset. For a billing portal that clients touch occasionally rather than daily, this is the right default.

Operationally, magic-link login is tied to the email on each client record, so the cleaner your client list, the smoother logins are. If you're moving clients over from a spreadsheet or your current tool, HubWho's CSV importer brings client records in at the start, and the email field on each record is what the magic link is sent to. Confirm those emails are current as part of onboarding so the first login lands in the right inbox.

Verify before you send the first client link

Before a real client ever sees the portal, run it yourself end to end. Open your custom subdomain over HTTPS and confirm the certificate is valid and there's no browser warning. Check that your logo, colors, and business name render on both the portal and a sample invoice. Then send a magic link to an email you control and click through to confirm login works on the live domain — not just on the default URL.

Treat this as a launch checklist, not a one-time thing: any time you change DNS, swap a logo, or rebrand, re-run the same three checks. The portal is where clients form their impression of how you handle their money, so it's worth the five minutes to confirm the domain resolves, the branding is right, and the login link works before it goes out.

• The portal URL resolves under your subdomain, not a platform URL
• Domain shows Active for the CNAME and Verified for the TXT record
• Invoice and reminder emails arrive from your sender domain with branding intact
• Magic-link login lands the client on their own data only, never another account's
• Pay now works end to end through your chosen provider, card and ACH

What clients see vs. what stays yours

White-labeling the portal is not just a logo swap. The point is that two layers stay cleanly separated: the surface your client touches is entirely your agency, and the operating layer underneath stays private to you. A client logging in at billing.yourclient.com sees your name, your colors, your sender address, and their own invoices and payment methods. They never see the platform name, your other clients, or any margin data.

On the client-facing side, the portal exposes only that client's invoices, payment history, year-to-date statement, active services, and saved payment methods. Everything is scoped to the single client, so one login can never reveal another account's data. The branded invoice and reminder emails arrive from your sender domain, so the entire paper trail reads as your agency from first touch to paid receipt.

What stays on your side of the wall is the part that makes the business run: your wholesale cost per line item, your per-client margin, your ARR and MRR, and your A/R aging. Margin is computed on demand from the wholesale-cost field on each invoice line, never surfaced to the client. That is the whole reason the wall matters. The client sees a clean bill under your brand; you see the real profit behind it.

Choosing your payment provider for the branded portal

A white-labeled portal still needs to move money, and HubWho lets you choose how. There are two paths, and the right one depends on whether you want to start collecting today or run payments through a merchant account you control. You can switch your approach as the agency grows.

The fast path is instant onboarding. It is close to immediate, so a new agency can be sending branded invoices and collecting card and ACH payments the same day, without waiting on underwriting. It is the simplest way to get the portal live and start drafting recurring subscriptions.

The control path is your own merchant account through Authorize.net or NMI. This suits agencies with higher recurring volume that want their own underwritten account, their own processing rates, and direct settlement, rather than collecting through a platform account. Either way, ACH bank-link via Plaid is available so high-ticket recurring clients can auto-draft from a business checking account. ACH lands in the low fractions of a percent, often around 0.8 percent capped at a small ceiling, versus roughly 2.9 percent plus 30 cents for cards. On a 2,000 dollar monthly invoice that is single-digit dollars on ACH against about 58 dollars on a card, which compounds fast across a recurring book.

Step-by-step

1. Add and verify your custom domain. In agency settings, enter the subdomain you want the portal to live at, such as billing.youragency.com. HubWho gives you a CNAME record and a TXT verification record to add at your DNS provider. Once both resolve, the domain shows Active and Verified, usually within minutes to a few hours.
2. Apply your branding. Upload your logo, set your accent color, and pick the default theme. The portal supports dark, light, and system-default via CSS variables, so it adapts to each client's OS preference with no extra setup on your side.
3. Set your sender domain and email templates. Point the from address to your own domain, for example billing@youragency.com, then open the email template editor to customize the invoice, quote, and reminder emails with your HTML and placeholder variables like client name, amount, and due date.
4. Choose your payment provider. Use instant onboarding, or wire up your own merchant account through Authorize.net or NMI if you want your own underwritten account and rates. Enable Plaid ACH bank-link so recurring clients can auto-draft from a business checking account at a fraction of card cost.
5. Turn on magic-link login. Enable magic-link login so each client signs in with a one-click link from their email instead of a password. Confirm the login flow is scoped per client so each person sees only their own invoices, statement, and payment methods.
6. Send a test invoice to yourself first. Before inviting a real client, send a test invoice to your own address. Confirm the portal URL resolves under your domain, the email comes from your sender, the branding renders, and Pay now works end to end. Then send the first real client link.

Frequently asked questions

Do I need a separate domain to white-label the portal?

No. You use a subdomain of your existing agency domain — for example billing.youragency.com — by adding one CNAME record in your DNS. Your main website and email keep working exactly as they do now; you're only delegating that single hostname to the portal.

How long does the CNAME change take to go live?

DNS propagation usually completes within a few minutes but can take up to a few hours depending on your provider and TTL settings. Add the record, then confirm the subdomain resolves over HTTPS before sending any client a link. If you're on Cloudflare, set the record to DNS-only (grey cloud) during setup so certificate validation isn't blocked.

What is magic-link login and is it secure for clients?

Magic-link login lets a client sign in by entering their email and clicking a one-time link sent to that inbox — no password to set or reset. It's tied to the email on each client record, so keeping those emails current keeps logins reliable. It removes the forgotten-password friction that otherwise stalls a payment at the worst moment.

Can clients still pay if I white-label the portal?

Yes. White-labeling changes only the branding and the URL, not the payment flow. Each client still sees a Pay now button on their invoices and can pay by card, by ACH bank-link through Plaid, or with a saved method. You choose the provider behind it, either instant onboarding, or your own merchant account through Authorize.net or NMI, and the client experience is the same branded portal either way.

Does the white-labeled portal show clients their own data only?

Yes. Each magic-link login is scoped to a single client. They see only their own invoices, payment history, year-to-date statement, active services, and saved payment methods. They never see your other clients, your wholesale costs, or your per-client margin, which stays on your side of the agency dashboard and is computed on demand.

Will my clients ever see the platform name behind the portal?

No, that is the point of white-labeling. With the custom CNAME, branded email sender, and email template editor set up, the portal URL, the invoice and reminder emails, and the portal screens all read as your agency. There is no platform reference in the client-facing experience once your domain and sender are verified.

Does white-labeling include automated payment reminders?

Not yet. You can configure the dunning policy today, including three reminder tiers and a late-fee rule, and those settings are saved against your branded templates. Automatically sending those reminders and retrying failed payments is on the roadmap, not shipped, so for now plan to trigger overdue follow-ups yourself while the schedule and copy wait in place.