Skip to content
Hardcount
Run it locally
Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Accept a team invitation

POST
/v1/auth/accept-invite
curl --request POST \
  --url http://localhost:8080/v1/auth/accept-invite \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example", "password": "example" }'

Consumes the single-use invite token (CAS — a replay or a race loses) and attaches the membership. If no account exists for the invited email, password is required (min 12 chars), the account is created, and a session cookie is minted (session_minted: true). An EXISTING account is attached WITHOUT a session — possession of the email alone must not log into an already-privileged account; the user signs in with their own password afterwards. ADR-081.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
token
required
string
password

Required (and validated) only when no account exists for the invited email; ignored otherwise.

string
>= 12 characters

Example generated

{
  "token": "example",
  "password": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Membership attached; cookie set when session_minted is true

Media typeapplication/json
object
user_id
required
string
email
required
string
tenant_id
required
string
session_minted
required
boolean
livemode
required
boolean
expires_at
required

Session expiry (RFC 3339) when session_minted; empty string otherwise.

string

Example generated

{
  "user_id": "example",
  "email": "example",
  "tenant_id": "example",
  "session_minted": true,
  "livemode": true,
  "expires_at": "example"
}

422

Section titled “422”

Token invalid/expired/revoked/used, or password does not meet policy

Media typeapplication/json
object
error
object
type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string
code
string
message
string
request_id
string
param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example 

{
  "error": {
    "type": "invalid_request_error"
  }
}