Base44 Tutorial: Build a Client Portal Step by Step

A step-by-step Base44 tutorial: plan, prompt, set up data, roles and security rules, test as a client, add email and publish a working client portal.

By Roenic Natarelli, Founder November 8, 2026 9 min read
The short answer
  • Plan the users, data and roles on paper before you write a single prompt.
  • Start with one detailed prompt, then change the app in small, specific steps.
  • Set row-level security on every entity so clients only see their own records.
  • Test the app logged in as a client before you share the link with anyone.

To build an app in Base44, you plan the data and roles, describe the app in one clear prompt, refine it in small steps, lock down who can see what, test it as a real user and then publish. This tutorial walks through each step using a client portal as the example, because almost every service business needs one and it touches every part of the platform.

We are a Base44 Legend Partner and Base44 Ambassador, and this is the same order we follow on client projects. If you are brand new, read what is Base44 first for the basics.

What will you build in this Base44 tutorial?

A portal where your clients log in, see their own projects and files, and send you messages. You and your team log in as admins and see everything.

  • Clients can view their own projects, download files and post messages.
  • Admins can create projects, upload files and see every client.
  • Email notifications go out when a new file or message arrives.

You can start on the free plan. It includes 25 message credits a month, which is enough to build a first version if your prompts are specific. Our guide to whether Base44 is free explains the limits.

Step 1: How should you plan the app before prompting?

Write three short lists on paper or in a doc. This takes 15 minutes and saves many credits.

  1. 1Users and roles. Who logs in? Here: clients and admins.
  2. 2Data. What gets stored? Here: projects, files and messages, each linked to a client.
  3. 3Screens. What does each role see? Here: a client dashboard, a project page and an admin view.

Step 2: What should your first Base44 prompt say?

Your first prompt should describe the users, the data, the screens and the rules in plain language. Specific prompts get better first drafts.

Example prompt: Build a client portal for a design agency. There are two roles: admin and client. Store Projects (name, status, due date, client email), Files (project, file, uploaded by) and Messages (project, text, sender). Clients log in and see only their own projects, files and messages. Admins see everything, create projects and upload files. Use a clean, professional layout with a sidebar.

Base44 will create the screens and the data tables, which it calls entities. Look through the preview before you change anything.

Step 3: How do you check the data model?

Open the data section and look at each entity. Check that every Project, File and Message has a field that ties it to a client, such as the client's email. That one field is what makes security rules possible in Step 5.

Base44 uses a MongoDB-compatible database, and every record automatically tracks who created it, according to the Base44 backend docs. If a link between entities is missing, ask for it directly: "Add a client email field to Projects and fill it when an admin creates a project."

Step 4: How do login and roles work in Base44?

Login is built in. Base44 supports email and password, social logins and custom SSO, so you do not need to connect a separate login service. Each user has a role, and admins can be set from the dashboard.

Ask Base44 to show different screens by role, for example: "If the user is an admin, show the admin view. Otherwise show the client dashboard." Hiding screens is not security on its own, which is why the next step matters.

Step 5: How do you make sure clients only see their own data?

Set row-level security (RLS) on every entity. RLS rules run on the server, so they protect data even if someone bypasses the screens. Base44 lets you set a rule for each of create, read, update and delete, as described in the Base44 security docs.

EntityReadCreateUpdate and delete
ProjectsAdmins, or the client whose email matches the project's client emailAdmins onlyAdmins only
FilesAdmins, or the matching clientAdmins onlyAdmins only
MessagesAdmins, or the matching clientAny logged-in userThe person who created it, or admins
Denied reads behave as if the data doesn't exist, so they don't reveal what's there.
Base44 documentation, entity security

Field-level security can hide individual fields too, such as an internal notes field only admins should see. Our Base44 security guide covers both in more depth.

Step 6: How do you refine the app without breaking it?

Change one thing per prompt and be specific about where. "Make it look better" spends credits and often moves things you liked. Try prompts like these instead:

  • "On the client dashboard, show projects as cards with status as a colored badge."
  • "On the project page, add a file list with a download button for each file."
  • "Sort messages newest first and show the sender name and time."

If a change goes wrong, roll back to an earlier version rather than asking the AI to undo it. That keeps the app clean.

Step 7: How do you test the portal as a client?

Create a second account with a different email and log in as a client in a private browser window. Then try to break your own rules.

  1. 1Confirm you see only the projects assigned to that client email.
  2. 2Copy the web address of another client's project and try to open it.
  3. 3Try to edit or delete a project as the client.
  4. 4Log out and check that no project data loads at all.

If any of these work when they should not, fix the RLS rules before going further.

Step 8: How do you add email notifications?

Base44 has a built-in email integration, so you can ask: "When an admin uploads a file, email the client." The Base44 integrations docs say built-in integrations work on any plan without separate API keys. Emailing people who have not signed up for your app needs a paid plan and a verified custom domain.

For more connections, such as Stripe payments, Slack alerts or a CRM, see our guide to Base44 integrations.

Step 9: How do you publish the portal?

Click publish and Base44 hosts the app for you. To use your own domain, such as portal.yourcompany.com, you need the Starter plan or higher, which also includes a free domain for the first year, per the pricing page. Custom domains get HTTPS automatically.

Step 10: What are good next steps after launch?

  • Mobile app. Clients can use the portal on their phones. If you want it in the App Store and Google Play, read our guide to publishing a Base44 app to the App Store.
  • GitHub sync. On the Builder plan and up, sync the code two ways with GitHub for backups and developer work.
  • Automations. Connect the portal to the rest of your business with our automation services.

For ideas on what else you can build, browse our list of Base44 examples. If you would rather have experts build it with you, see our Base44 developers page.

Want your client portal built right the first time? We can build it with you.

Frequently asked questions

Is Base44 easy for beginners?

Yes. You describe the app in plain language and Base44 builds the screens, database and login. The parts beginners most often miss are planning the data first and setting security rules, which this tutorial covers.

How long does it take to build an app in Base44?

A simple first version can come together in an afternoon. A portal ready for real clients usually takes longer because of testing, security rules and polish.

Can I build a Base44 app for free?

Yes. The free plan includes 25 message credits a month and up to 5 apps. You need the Starter plan or higher to connect a custom domain.

Do I need to know how to code to use Base44?

No. You can build a complete app with prompts. Knowing a little about data and permissions helps you write better prompts and set up security correctly.

How do I stop clients from seeing each other's data in Base44?

Set row-level security on every entity so a client can only read records tied to their own email or user ID. Then test it by logging in as a client and trying to open another client's record.

Roenic Natarelli
Founder, Virtual Horizons

Roenic runs Virtual Horizons and is a Base44 Legend Partner, Ambassador and Community Pillar, Base44 Shark Tank winner and multiple-time Vibe Sprint winner. The studio builds web and mobile apps, AI voice agents and automations, with more than 10 apps live on the App Store and Google Play. More about us

Sources

  1. 1.Base44 documentation: Backend features
  2. 2.Base44 documentation: Entity security
  3. 3.Base44 documentation: Using integrations
  4. 4.Base44 pricing

Keep reading