Invites

Challenge-based verification flow for invited (external) users

📄️Request an invite acceptance code

Public endpoint (no auth) used by an invited external user to request a 6-character verification code by email, ahead of setting their password. Rate-limited per email (5 requests per 1-hour window).

📄️Validate an invite code and create the user account

Public endpoint (no auth). On success creates the local user account, converts all pending invites for that email into bucket memberships, and issues full access/refresh cookies.