Skip to main content

Accept Invitation

POST 
/api/v1/auth/accept-invite

Accept a workspace invitation and optionally set password.

Security features:

  • Uses Invitation model with hashed token storage
  • Atomic transaction prevents race conditions on double-accept
  • Token validated via SHA256 hash comparison
  • Single-use enforcement (used_at timestamp)
  • Sibling invites auto-revoked on acceptance
  • Clears stale verification tokens on acceptance

Strict email-match guard against an authenticated session: if the request carries a valid JWT and the authenticated user's email does NOT match the invitation's email, reject with 409 + error_code INVITE_EMAIL_MISMATCH. This is enforced on the password path as well as the Google sign-in path, as a defense-in-depth check for any caller (web, raw API consumers).

Args: data.token: Invitation token (plaintext, will be hashed for lookup) data.invite_id: Invitation ID (UUID) data.password: New password (optional for existing users with password)

Returns: 200: Success with access/refresh tokens 400: Invalid state (already used, revoked, expired, invalid password) 404: Invalid token/invite_id combination 409: Authenticated session email does not match invitation email

Request​

Responses​

OK