No username/password needed.
Email link (most common): Estimate/invoice emails contain a secure link that auto-authenticates the client. Session lasts 30 days.
Magic link: Clients visiting the portal URL enter their email to receive a one-time link (valid 15 minutes).