Build a customer portal

Expose a narrow server-side support experience without leaking ThriveDesk credentials.

A customer portal should call your backend, which authenticates the customer and then calls ThriveDesk. Never put a ThriveDesk bearer token in browser or mobile application code.

Customer browser → Your authenticated backend → ThriveDesk API
                                      ↓
                              tenant authorization

Map the signed-in application's customer ID to a ThriveDesk contact ID. Before returning any conversation, verify it belongs to that contact. Return only fields the portal needs.

curl "https://api.thrivedesk.com/v1/contacts/CONTACT_ID/conversations?limit=20" \
  -H "Authorization: Bearer $THRIVEDESK_TOKEN"

Use the contact conversation endpoint for lists and fetch a conversation only after authorization. Proxy attachment downloads through the same authorization boundary.

Errors

Translate upstream 401/403 into a generic portal error, return 404 rather than revealing another customer's record, and rate-limit both the customer session and your ThriveDesk client.

Create tickets from your app

Start a ThriveDesk conversation from a server-side application without exposing an API token.

Bulk import and backfill

Import contacts or conversations safely within API limits and without duplicate writes.

Recommended architecture
Errors
Related