API Reference

Accept invite and set password

POST /api/auth/accept-invite

Accepts an invite token and sets the user's password. When TOTP is required, generates a TOTP secret for enrollment. When TOTP is disabled (auth.totp_required: false), issues a full session immediately. The token is marked as used after this call; when TOTP is required, invite validation can still return totp_pending: true until verification completes.

Operation IDacceptInvite

Authentication

No authentication is required.

Request body

This request body is required.

Content typeapplication/json

requestobject

2 properties

tokenstringrequired

passwordstringrequired

Minimum length: 8

Success response body

200Password set. When TOTP is required, returns TOTP enrollment data. When TOTP is disabled, returns `{ authenticated: true }` with a authenticated browser session.

Password set. When TOTP is required, returns TOTP enrollment data. When TOTP is disabled, returns { authenticated: true } with a authenticated browser session.

Content typeapplication/json

responseobject

3 properties

totp_secretstring

totp_uristring

authenticatedboolean

Error responses

400Invalid/expired token or validation error

Invalid/expired token or validation error

No response content schema is documented.

Code examples

curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/accept-invite' \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string",
  "password": "string"
}'

const response = await fetch("https://your-envoy.example.com/api/auth/accept-invite", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "token": "string",
    "password": "string"
  }),
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);