Accept invite and set password

POST /api/auth/accept-invite

Accepts an invite token and sets the user's password. When TOTP is required, generates a TOTP secret for enrollment. When TOTP is disabled (auth.totp_required: false), issues a full session immediately. The token is marked as used after this call; when TOTP is required, invite validation can still return totp_pending: true until verification completes.

Operation ID: acceptInvite

Authentication

No authentication is required.

Request body

The request body is required.

application/json

• Type: object
• Properties:
  • token (string, required)
  • password (string, required)

Success responses

200

Password set. When TOTP is required, returns TOTP enrollment data. When TOTP is disabled, returns { authenticated: true } with a full session cookie.

Content type: application/json

• Type: object
• Properties:
  • totp_secret (string)
  • totp_uri (string)
  • authenticated (boolean)

Error responses

400

Invalid/expired token or validation error

Examples

cURL

curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/accept-invite' \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string",
  "password": "string"
}'

JavaScript (fetch)

const response = await fetch('https://your-envoy.example.com/api/auth/accept-invite', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "token": "string",
    "password": "string"
  }),
});
 
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);