What the portal is for
The customer portal is the place to view service status, usage, billing information and purchased capabilities. Sensitive account state should not be stored in public page code.
Secure handoff
The production integration should use a server-managed session or short-lived handoff mechanism. Access tokens should not be placed in shareable URLs, browser history or referrer logs.