skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

secure-invite-system

Implement token-based organization invitations with email binding and single-use tokens.

Updated Mar 29, 2026
Search Tags:#security#rate-limiting#tenant#invite#token-based#revocation#email-binding
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill secure-invite-system
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secure-invite-system
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/secure-invite-system
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill secure-invite-system

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Streamline secure onboarding of team members by providing a token-based invitation workflow that securely binds invites to email addresses, enforces single-use tokens, and supports revocation and expiry to prevent abuse.

Core Features & Use Cases

  • Token-based invitations with server-side token hashing to avoid storing raw tokens.
  • Email-binding to prevent invite link forwarding and ensure the invitee is the owner of the email.
  • Per-tenant rate limiting and per-inviter controls to prevent invite spam.
  • One-time acceptance flows for both registered and unregistered invitees.
  • Invite revocation, expiry management, and audit-ready events.
  • Optional domain allowlisting for enterprise-grade security.

Use Case: Onboard a new team member across multiple tenants with automated invite processing and strict access controls.

Quick Start

Configure a token-based invite flow that binds invites to the invited email, enforces single-use tokens, and expires invites after 72 hours.

Frequently Asked Questions about secure-invite-system

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement a secure token-based organization invite system?▼

Token-based invitations secure onboarding by binding tokens to invitee emails and enforcing single-use acceptance. They prevent forwarding abuse through server-side hashing while supporting revocation, expiry, and per-inviter rate limits.

How do I prevent invite link forwarding in a multi-tenant application?▼

Prevent invite link forwarding by binding each token to the invited email address. This ensures only the verified email owner can accept the invite, stopping unauthorized users from using shared links across tenants.

How do I handle expired or revoked invitation tokens?▼

Handle expired or revoked tokens by enforcing expiry timelines and supporting manual revocation. The system checks token validity during the acceptance flow, automatically rejecting access for any revoked or time-expired invites.

How do I configure per-inviter rate limits for organization invites?▼

Configure per-inviter rate limits by setting thresholds on how many invitations a single user can generate. This prevents invite spam across tenants and pairs with optional per-tenant domain allowlisting for enterprise security.

Do I need to store raw invitation tokens in the database?▼

You do not need to store raw invitation tokens in the database. The system uses server-side token hashing, meaning only hashed versions are persisted to protect sensitive data while still validating single-use acceptance.

Can I restrict organization invites to specific email domains?▼

Restrict organization invites to specific email domains using per-tenant domain allowlisting. This enterprise-grade security feature ensures only users from approved domains can receive and accept invitations.

Related Skills

Explore More Software Engineering Skills→
steedossteedos
1.6k

steedos-auth

Authenticate users in multi-tenant Steedos spaces with JWT, cookies, and API keys.

Official
Advanced
FenixAllianceFenixAlliance

absuite-onboarding

Guide ABS tenant onboarding via REST API with correct endpoint sequencing.

Official
Intermediate
ArtisanClarinetsArtisanClarinets

prisma-data-model

Enforce tenant isolation and audit-ready mutations in Prisma data models.

Community
Intermediate
thesammykinsthesammykins

pocket-id-provider

Deploy Pocket-ID with persistent storage and configure OIDC clients for passkey authentication.

Community
Advanced