Invitations

An invitation is a pending offer for someone to join your organization with a specific role. The invitee accepts by clicking the link in the email they receive.

Sending an invite

An admin (or any member with permission to manage memberships) sends an invite from Members then Invite. They specify:

Email address of the invitee.
Role the invitee will hold once they accept.

The system sends an email with a one-time link. The invitee accepts by following the link, signing in (or creating an account, if they do not have one), and confirming. They become a member with the role you picked.

Domain restrictions

An organization can require invited email addresses to belong to one of a configured set of domains. Set this in the organization’s general settings: “Allowed email domains” takes a list like yourcompany.com, contractor.com. Invitations to addresses outside that list are rejected.

Leave the list empty to allow any email.

Expiry

An invitation token expires after seven days. Expired invitations can be resent (which mints a new token); the invitee uses the new link.

A used invitation token cannot be reused: the token has the invitation’s accepted_at timestamp baked in, so as soon as it is accepted, the same link stops working.

Revoking

An admin can revoke a pending invitation at any time. The token is invalidated; the link in the email stops working.

Resending

If an invitee did not receive the email, an admin can resend. The resend mints a fresh token and a fresh email.

Once accepted

When an invitation is accepted, the system:

Creates a membership linking the user to the organization with the chosen role.
Marks the invitation as accepted (records the accepted_at timestamp).
Writes an audit log entry attributed to the invitee.

The invitee shows up in the Members list immediately.

Members and roles for what each role can do.
Audit log for the join record.