Operator invitations

An installation operator can invite the first customer account from the repository root. This requires configured local identity, database and SMTP settings plus the protected invitation service-account credential.

Invite an account

Replace the bracketed value with an email address you intend to invite:

pnpm auth:invite --email <customer-email>

The command prepares the account and sends the identity service’s email verification/password setup action. The link is valid for 72 hours. It does not grant a workspace membership or any platform administration role.

The customer completes setup, signs in and can create a workspace. Existing workspace Owner/Admin users can also prepare new accounts through team invitations.

Retry an incomplete invitation

An explicit resend is required:

pnpm auth:invite --email <customer-email> --resend

An already registered account is never reset by this command. If identity creation succeeded but mail failed, fix mail delivery and retry the incomplete invitation with --resend; do not delete/recreate the account.

A timeout may leave delivery unconfirmed because SMTP could have accepted the message. Check the mailbox before resending. The command must not be treated as successful delivery when it reports a failure or unknown result.

Protect operator access

The invitation credential can manage realm users. Keep it limited to authorized operator tooling. It must not be passed to the panel, browser or ordinary API runtime.

The local environment file includes several roles for convenience. Deployment must separate runtime configuration from migration and operator credentials.