How to Enable Can View Their Invoices Authorization via Halo PSA SSO

Overview

Benji Pays now supports a new Halo PSA SSO feature that allows finer control over user access to invoices in the Benji Pays Customer Portal. If you're using Halo PSA as your Identity Provider (IdP) for SSO, you can now also use it for authorization based on user-level permissions in Halo.

This new feature adds an additional layer of security by validating that a user has the specific “Can view their invoices” permission enabled in Halo before granting access to invoices in the portal.

How It Works

1. In the Benji Pays portal, go to Settings > Portal > SSO Configuration and either edit an existing Halo PSA SSO configuration or create a new one.
2. You’ll now see an additional setting under Authentication Settings:
   • Standard Benji Pays Authorization Enabled: Uses emails on file in Benji Pays (as you're used to).
   • Halo “Can view their invoices” Authorization: Validates each login via Halo to confirm if the user has the “Can view their invoices” permission.

3. You may choose to enable one or both methods. If you enable only the Halo-based authorization and the permission is not set in Halo, the user will not have invoice access in the portal.

Setting Permissions in Halo PSA

To grant a user invoice access:

1. Log into your Halo PSA admin portal.
2. Navigate to Clients > Users.
3. Select the relevant user (e.g. Avery Davidow).
4. Click the Permissions tab.
5. Scroll down and locate the “Can view their invoices” setting.
6. Click Edit, check the box, and click Save.

Without this permission enabled, the user will not be able to view invoices via the Halo SSO login.

Important Notes

• This feature only affects users logging in via the Halo PSA SSO button in the customer portal.
• At least one authorization method must be enabled; otherwise, users will not be granted portal access.

Troubleshooting & Support

If you experience any issues or have feedback, please reach out to our support team. We're here to help!