Ben Leonard's business ran on Pixieset, Google Drive and Square. Here's how I pulled all of it onto his own site as one branded client portal, with Supabase and Cloudflare R2 standing in for the logins Webflow took away.
Ben Leonard shoots photos and films for athletes, apparel brands and gyms here in Bellingham under BL Motion Media. It's a real business with real clients, and he's almost never sitting still. He's traveling, shooting or editing.
The whole business ran on other people's platforms. His files went out through Pixieset and Google Drive, and the bill went through Square. It all worked, but every client got a handful of links that looked nothing alike, and none of them looked like him. I wanted to pull all of it onto his own site: one login to watch the film, grab the photos and pay, without adding one more app or one more hour to his week.
The problem was logins. Webflow switched off User Accounts on every site on January 29, 2026. They didn't move it to a higher plan. It's just gone, so there's no native login to build on.
((Webflow's own notice says it's leaning on "vetted app partners" instead.)) Pixieset didn't have real logins either. Each gallery gets a password, and that's the whole security model. So whatever I built, the login was on me.
At first, I decided not to build a portal at all. The plugins I looked at hid pages with JavaScript, none of them stored video, and most of them wanted a monthly fee on top of his Webflow plan. It looked like a lot of money for something that still couldn't handle his films.
Then I slept on it and got annoyed at my own answer. "Not a great option" and "no option" are different things, and I'd written it like the second one. So I went back and compared everything instead of ruling it out: Memberstack, Outseta, Assembly, plain Webflow page passwords, and building it myself.
I had four rules. It had to be branded and on his own domain. It had to be cheap. Square had to stay. And he couldn't have to learn another piece of software. None of the client portal apps I checked took Square, and the good ones charged extra to take their own branding off.
The site stays on Webflow. Logins run on Supabase. Files live in Cloudflare R2. The Pay button is a Square link. All of it sits on two pages of his site: /clients for his clients, and /studio for him.
I compared R2 with Backblaze B2. B2 is cheaper to store, about $6.95 a terabyte against R2's $15. But R2 charges nothing for downloads, ever, and when you're handing out multi-gig files, that matters more than the storage price. For the amount he stores, the difference was a few dollars a month.
He has roughly 100 GB across seven clients. R2 gives you the first 10 GB free and charges a cent and a half per GB after that, so storage runs him about $1.35 a month.
1. Make the bucket private. Nothing in it is public, so guessing a file's URL gets you nothing. I also locked it so only his domain can talk to it.
2. Put a middleman in front of it. A Supabase Edge Function sits between the site and the storage. It checks who's signed in, finds the files that belong to them, and hands back a download link that expires in 12 hours. Forward that link to a friend next week and it won't open.
3. Wall off every client. Supabase's row level security is what actually keeps each client's files separate. Even if someone digs through the page code, the database only returns rows for the account that's signed in. That's the part you can't do safely with JavaScript running in the browser.
4. Build the client page. /clients starts with a login, then drops them straight into their project. The main film sits at the top, the full set underneath with the file count and size, and they can filter films from stills, open anything full screen, and download one file or all of it. The balance sits on the same screen as the files, with a Pay button that opens Square. If nothing's owed, the button doesn't show up.
5. Build the owner page. This is where Ben actually works. On /studio he adds a client with an email and a generated temporary password he can copy and send, types in the project and the balance, pastes the Square link, and drags the files in. Deleting a file there deletes it from storage too, so he's never paying to keep something nobody can see.
6. Deal with big files. The R2 dashboard's uploader tops out around 315 MB a file, which is nothing for a film. So uploads get cut into 64 MB pieces, three go up at a time, and any piece that fails tries again on its own.
7. Test it with a fake client. I made a demo account and ran the whole visit on desktop and on my phone: log in, play, download, pay. I did it again after every change.
Password resets. Supabase's built-in email only sends to people on your own Supabase team. Every reset I tested worked perfectly because I was on the team. For a real client, it would have failed silently. Hook up your own email sender before anyone real gets an account. I'm setting his up with Resend.
((Supabase says it plainly in its email docs. I just hadn't read that page yet.)) Free projects fall asleep. A free Supabase project pauses after a week with no activity. That's fine for a side project. It's a problem when a client might only open the portal once a month. Plan for a keep-alive or the paid tier.
The 90-day cleanup. These are delivery copies, not his archive. He keeps the masters on his own drives, and sets come down 90 days after delivery so storage stays around that 100 GB. Right now that's a habit, not something the site does on its own. That's next on my list.
His clients will see the portal a handful of times a year. He's going to be in /studio every week. So that's the page I spent the most time making simple, because if it wasn't easy, he'd be back on Pixieset by spring.
If you want to see the whole build, the BL Motion case study has screenshots of both pages. And if you're an athlete or a brand in the Northwest who needs someone behind the camera, go look at Ben's work at blmotion.com.
