Skip to main content

Accept Invitation Passwordless

POST 
/api/v1/auth/accept-invite/passwordless

Accept a workspace invitation without setting a password (Issue #614).

The invitation link becomes the invitee's first sign-in. The account is created with set_unusable_password(); setting a password is optional and is covered later by the ordinary forgot-password flow.

The scope guard is the whole security story: this endpoint may only sign in an account that has no credential of its own. Anything with a usable password or a linked identity provider is refused with the same error codes /accept-invite already returns, so the clients need no new error handling.

Every refusal code here is one the password-less probe on /accept-invite already returns for the same token, and reaching any of them requires holding a live, unexpired, unused token minted for that exact address. This endpoint therefore discloses nothing the existing probe does not.

Returns: 200: Success with access/refresh tokens (and Set-Cookie, as /accept-invite) 400: Invalid state, or an account that must prove itself instead 404: Invalid token/invite_id combination 409: Authenticated session email does not match invitation email

Request​

Responses​

OK