Public portfolios are great for discovery — until you want privacy for detailed experience, contacts, and private project notes.
Approach
- Generate OTP server-side and email it with Resend
- Sign a short-lived challenge, then a longer session token
- Keep resume HTML behind an authenticated API (not in public source)
Trade-offs
This is friction by design. Visitors prove email ownership before content loads. It is not enterprise IAM, but it is a solid fit for a personal portfolio that should stay invite-style.