Error
Customer teams
Accept an invitation
Takes two proofs, not one. The token proves the invitation — that this seat was offered to this address. The contact session proves the person. So the invited address must be an identity of the signed-in contact: a forwarded link seats nobody (invitation_not_yours).
An email becomes an identity when something makes it one — hosted sign-up, a magic link, a six-digit code, or your own server calling POST /v1/contacts with it. Passing an address to /v1/boot in federated mode deliberately does not.
An invitation belongs to one environment. A contact of the other one is refused with the same invalid_token as an expired link.
POST
Error