# Building a Vendor and Supplier Portal Integrated with Your Custom ERP

> How to design and build a self-service vendor portal that lets suppliers submit invoices, track payments, update documents, and collaborate directly with your ERP procurement module.

URL: https://www.matthewswong.com/en/blog/erp-vendor-supplier-portal/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Published: 2025-06-10
- Updated: 2025-06-10
- Category: ERP

In 2025, 85% of B2B companies offer an online supplier or vendor portal, up from 68% just a year prior. The business case is clear: a vendor portal reduces AP processing costs by eliminating manual invoice keying, speeds up payment cycles, and improves supplier relationships. For Indonesian manufacturing and trading companies that manage hundreds of vendors — many of whom still email PDF invoices and follow up via WhatsApp — a vendor portal is a significant operational upgrade. In my freelance ERP consulting work, I built a vendor portal integrated directly with a client's custom ERP procurement and AP modules. This post covers the architecture and lessons learned.

## What a Vendor Portal Actually Needs

A production vendor portal needs four core capabilities: invoice submission (vendor uploads invoice PDF, enters line items, maps to PO), payment tracking (vendor can see payment status for each invoice), document management (vendor updates bank details, tax documents, legal certificates), and communication (structured messages linked to specific POs or invoices). All of these must be integrated with the ERP — a standalone portal that doesn't sync with the ERP just creates a parallel data silo.

### Vendor Authentication and Onboarding

I use a separate vendor-facing Next.js application (not the internal ERP frontend) with its own authentication. Vendors register with their NPWP (Indonesian tax registration number), business name, and email. The ERP admin approves registrations and links the vendor account to the vendor master in the ERP. Once linked, the vendor can see all POs issued to them and submit invoices against those POs. The authentication uses JWT with shorter expiry (4 hours) than internal users, given the external facing nature.

> From my experience building ERP systems as a freelance ERP consultant: give vendors a mobile-friendly portal, not just a desktop one. Many Indonesian supplier contacts operate primarily on mobile — they'll photograph an invoice and submit it from their phone. I built the portal as a PWA with mobile-optimized forms. Invoice photo capture (with automatic PDF conversion using pdf-lib) was the most-used feature in the first month. A portal that only works on desktop gets abandoned by vendors.

## Invoice Submission and Three-Way Matching

The invoice submission flow: vendor selects a PO from their open POs, confirms the line items and quantities being invoiced, enters the invoice number and date, uploads the PDF, and submits. The ERP automatically runs three-way matching: invoice quantity vs. PO quantity vs. goods receipt quantity. If all three match within tolerance, the invoice is auto-approved to payment queue. If there's a discrepancy, it flags for AP team review. This eliminates 80% of manual AP matching work.

### Payment Status Visibility

Vendors can see a payment tracker for each invoice: submitted, under review, approved, payment scheduled (with expected payment date), and paid (with bank transfer reference). This visibility almost entirely eliminates the 'when will I get paid?' calls to the AP team. In one client engagement, I found that 60-70% of AP team phone calls were vendor payment inquiries — all eliminated by the portal. The payment scheduled status updates automatically when finance creates a payment batch in the ERP, and the paid status updates when the bank transfer confirmation is uploaded.

> **Warning: Vendor Data Security**

> The vendor portal contains sensitive financial data — payment amounts, bank account details, tax documents. Row-level security in PostgreSQL must ensure each vendor can only see their own data. I had an early implementation where a misconfigured API endpoint returned all vendors' payment statuses if the vendor_id parameter was tampered with. Always use PostgreSQL RLS policies on the vendor-facing tables, and test thoroughly with multiple vendor accounts before go-live. An IDOR (Insecure Direct Object Reference) vulnerability in a payment portal is a serious breach.

## How I Approached This

The vendor portal is a separate Next.js application that calls the same NestJS API as the internal ERP, but with vendor-scoped API keys. The NestJS vendor module enforces vendor_id on every query using a custom guard that extracts the vendor from the JWT and injects it into every service call. The portal frontend is deployed to Cloudflare Pages for performance and DDoS protection. The internal ERP's AP module has a 'vendor portal' tab on each invoice showing the vendor's submitted data and any messages.

## Document Management for Vendor Compliance

Indonesian procurement regulations require vendors to maintain current PKP (Pengusaha Kena Pajak) certificates, NPWP, SIUP (business license), and for some sectors, ISO or SNI certifications. The portal I built lets vendors upload and update these documents. The ERP tracks expiry dates and flags vendors whose documents are expiring in 30 or 60 days — the procurement team is notified and cannot issue new POs to vendors with expired compliance documents. This replaced a manual spreadsheet the procurement manager was maintaining for vendor compliance.

## Measuring the Impact

Six months after launching the vendor portal for my client, the measurable improvements were: AP processing time per invoice dropped from 45 minutes to 8 minutes (three-way matching automation), vendor payment inquiry calls dropped by 65%, on-time payment rate improved from 72% to 91% (because the payment scheduling was more transparent and accountable), and vendor onboarding time reduced from 5 days to 1 day (digital document submission). The client's CFO described it as 'the single most impactful module we've deployed.'

## Sources & Further Reading

- ValueDX — Vendor Portal: 10 Powerful Benefits of a Smart Supplier Portal in 2025 — https://valuedx.com/vendor-portal/
- HighRadius — What Is a Supplier Portal & How to Choose the Right One — https://www.highradius.com/resources/Blog/what-is-a-supplier-portal/
- Serrala — Supplier Invoice Portal: B2B Vendor Collaboration Software — https://www.serrala.com/ap-automation/supplier-invoicing-portal

> **Key takeaway:** In 2025, 85 percent of B2B companies ran a supplier or vendor portal, up from 68 percent a year before. The case is accounts payable cost: a portal where vendors submit invoices and check payment status directly removes the manual entry and the chasing emails around it.

## Source links

- https://valuedx.com/vendor-portal/
- https://www.highradius.com/resources/Blog/what-is-a-supplier-portal/
- https://www.serrala.com/ap-automation/supplier-invoicing-portal

## FAQ

### What are the four core capabilities a vendor portal must have to integrate properly with an ERP?

A production vendor portal needs invoice submission (uploading PDF invoices and mapping line items to purchase orders), payment tracking (visible status for each invoice), document management (bank details, tax documents, legal certificates), and structured communication linked to specific POs or invoices. All four must sync with the ERP — a standalone portal that doesn't connect to the ERP simply creates a parallel data silo.

### How does three-way matching work in the invoice submission flow?

When a vendor submits an invoice, the ERP automatically compares three quantities: the invoiced quantity, the PO quantity, and the goods receipt quantity. If all three match within tolerance, the invoice is auto-approved and moved to the payment queue. Any discrepancy flags the invoice for AP team review, which in practice eliminates around 80% of manual AP matching work.

### Why was a PWA with mobile-optimized forms chosen for the vendor portal, rather than a standard desktop web app?

Many Indonesian supplier contacts operate primarily on mobile phones, photographing invoices and submitting them on-the-go. Building the portal as a PWA with mobile-optimized forms — including invoice photo capture with automatic PDF conversion using pdf-lib — made it practical for those users. Invoice photo capture turned out to be the most-used feature in the first month, confirming that a desktop-only portal would have been abandoned by vendors.

### What security risk was discovered during development, and how was it mitigated?

An early misconfigured API endpoint returned payment statuses for all vendors if the vendor_id parameter was tampered with — an Insecure Direct Object Reference (IDOR) vulnerability. The fix was to apply PostgreSQL row-level security (RLS) policies on all vendor-facing tables and enforce vendor_id on every query using a custom NestJS guard that extracts the vendor identity from the JWT. Thorough testing with multiple vendor accounts before go-live is essential to catch this class of vulnerability.

### What measurable impact did the vendor portal have six months after launch?

AP processing time per invoice dropped from 45 minutes to 8 minutes, vendor payment inquiry calls fell by 65%, on-time payment rate improved from 72% to 91%, and vendor onboarding time was cut from 5 days to 1 day. The client's CFO called it 'the single most impactful module we've deployed.'

---

- HTML version: https://www.matthewswong.com/en/blog/erp-vendor-supplier-portal/
- Bahasa Indonesia: https://www.matthewswong.com/id/blog/erp-vendor-supplier-portal/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json