[{"data":1,"prerenderedAt":675},["ShallowReactive",2],{"navigation":3,"\u002Fauth\u002Fuser-invitations":189,"\u002Fauth\u002Fuser-invitations-surround":670},[4,34,60,116,137,153],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":33},"Getting Started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,15,18,23,28],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":5,"path":16,"stem":17,"icon":6},"\u002Fgetting-started\u002Fgetting-started","1.getting-started\u002F2.getting-started",{"title":19,"path":20,"stem":21,"icon":22},"Choosing a Preset","\u002Fgetting-started\u002Fchoosing-a-preset","1.getting-started\u002F3.choosing-a-preset","i-lucide-git-branch",{"title":24,"path":25,"stem":26,"icon":27},"Deployment","\u002Fgetting-started\u002Fdeployment","1.getting-started\u002F4.deployment","i-lucide-cloud",{"title":29,"path":30,"stem":31,"icon":32},"Background Maintenance","\u002Fgetting-started\u002Fbackground-maintenance","1.getting-started\u002F5.background-maintenance","i-lucide-timer-reset",false,{"title":35,"icon":36,"path":37,"stem":38,"children":39,"page":33},"Build","i-lucide-wrench","\u002Fbuild","2.build",[40,45,50,55],{"title":41,"path":42,"stem":43,"icon":44},"Routers & Prefixes","\u002Fbuild\u002Frouters-and-prefixes","2.build\u002F1.routers-and-prefixes","i-lucide-route",{"title":46,"path":47,"stem":48,"icon":49},"Configuration","\u002Fbuild\u002Fconfiguration","2.build\u002F2.configuration","i-lucide-settings",{"title":51,"path":52,"stem":53,"icon":54},"Authorization Dependencies","\u002Fbuild\u002Fauthorization-dependencies","2.build\u002F3.authorization-dependencies","i-lucide-shield-check",{"title":56,"path":57,"stem":58,"icon":59},"Command Line","\u002Fbuild\u002Fcli","2.build\u002F4.cli","i-lucide-terminal",{"title":61,"icon":62,"path":63,"stem":64,"children":65,"page":33},"Auth","i-lucide-lock","\u002Fauth","3.auth",[66,71,76,81,86,91,96,101,106,111],{"title":67,"path":68,"stem":69,"icon":70},"OAuth & Social Login","\u002Fauth\u002Foauth-and-social-login","3.auth\u002F1.oauth-and-social-login","i-lucide-log-in",{"title":72,"path":73,"stem":74,"icon":75},"Multi-Frontend Support","\u002Fauth\u002Fmulti-frontend","3.auth\u002F10.multi-frontend","i-lucide-layout-grid",{"title":77,"path":78,"stem":79,"icon":80},"Sessions & Audit","\u002Fauth\u002Fsessions-and-audit","3.auth\u002F2.sessions-and-audit","i-lucide-monitor-smartphone",{"title":82,"path":83,"stem":84,"icon":85},"Passwordless & Messaging","\u002Fauth\u002Fpasswordless-and-messaging","3.auth\u002F3.passwordless-and-messaging","i-lucide-mail",{"title":87,"path":88,"stem":89,"icon":90},"JWT Tokens","\u002Fauth\u002Fjwt-tokens","3.auth\u002F4.jwt-tokens","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"User Management API","\u002Fauth\u002Fuser-management-api","3.auth\u002F5.user-management-api","i-lucide-users",{"title":97,"path":98,"stem":99,"icon":100},"User Invitations","\u002Fauth\u002Fuser-invitations","3.auth\u002F6.user-invitations","i-lucide-send",{"title":102,"path":103,"stem":104,"icon":105},"Roles & Permissions","\u002Fauth\u002Froles-and-permissions","3.auth\u002F7.roles-and-permissions","i-lucide-shield",{"title":107,"path":108,"stem":109,"icon":110},"ABAC","\u002Fauth\u002Fabac","3.auth\u002F8.abac","i-lucide-filter",{"title":112,"path":113,"stem":114,"icon":115},"User Status","\u002Fauth\u002Fuser-status","3.auth\u002F9.user-status","i-lucide-user-cog",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":33},"Enterprise","i-lucide-building-2","\u002Fenterprise","4.enterprise",[122,127,132],{"title":123,"path":124,"stem":125,"icon":126},"Core Authorization Concepts","\u002Fenterprise\u002Fcore-authorization-concepts","4.enterprise\u002F1.core-authorization-concepts","i-lucide-network",{"title":128,"path":129,"stem":130,"icon":131},"Entities","\u002Fenterprise\u002Fentities","4.enterprise\u002F2.entities","i-lucide-folder-tree",{"title":133,"path":134,"stem":135,"icon":136},"Entity Memberships","\u002Fenterprise\u002Fentity-memberships","4.enterprise\u002F3.entity-memberships","i-lucide-user-plus",{"title":138,"icon":139,"path":140,"stem":141,"children":142,"page":33},"Integrations","i-lucide-plug","\u002Fintegrations","5.integrations",[143,148],{"title":144,"path":145,"stem":146,"icon":147},"API Keys","\u002Fintegrations\u002Fapi-keys","5.integrations\u002F1.api-keys","i-lucide-key",{"title":149,"path":150,"stem":151,"icon":152},"OutlabsAuth UI","\u002Fintegrations\u002Foutlabsauth-ui","5.integrations\u002F2.outlabsauth-ui","i-lucide-layout-dashboard",{"title":154,"icon":155,"path":156,"stem":157,"children":158,"page":33},"Reference","i-lucide-book-marked","\u002Freference","6.reference",[159,164,169,174,179,184],{"title":160,"path":161,"stem":162,"icon":163},"Data Models","\u002Freference\u002Fdata-models","6.reference\u002F1.data-models","i-lucide-database",{"title":165,"path":166,"stem":167,"icon":168},"Activity Tracking","\u002Freference\u002Factivity-tracking","6.reference\u002F2.activity-tracking","i-lucide-activity",{"title":170,"path":171,"stem":172,"icon":173},"Testing","\u002Freference\u002Ftesting","6.reference\u002F3.testing","i-lucide-flask-conical",{"title":175,"path":176,"stem":177,"icon":178},"Observability","\u002Freference\u002Fobservability","6.reference\u002F4.observability","i-lucide-eye",{"title":180,"path":181,"stem":182,"icon":183},"Metrics Reference","\u002Freference\u002Fmetrics-reference","6.reference\u002F5.metrics-reference","i-lucide-chart-bar",{"title":185,"path":186,"stem":187,"icon":188},"Log Events Reference","\u002Freference\u002Flog-events-reference","6.reference\u002F6.log-events-reference","i-lucide-scroll-text",{"id":190,"title":97,"body":191,"description":663,"extension":664,"links":665,"meta":666,"navigation":667,"path":98,"seo":668,"stem":99,"__hash__":669},"docs\u002F3.auth\u002F6.user-invitations.md",{"type":192,"value":193,"toc":654},"minimark",[194,201,213,264,271,274,279,294,353,369,371,374,421,430,439,445,447,451,459,466,468,476,563,581,591,593,597,614,623,625,629,650],[195,196,197],"note",{},[198,199,200],"p",{},"Onboarding by email.",[198,202,203,204,208,209,212],{},"Invite users by email without setting a password for them. They open a\ntoken-based link, choose a password, and the account activates\n(",[205,206,207],"code",{},"INVITED"," → ",[205,210,211],{},"ACTIVE",") with a JWT session.",[214,215,216,229],"table",{},[217,218,219],"thead",{},[220,221,222,226],"tr",{},[223,224,225],"th",{},"Concern",[223,227,228],{},"Owner",[230,231,232,241,253],"tbody",{},[220,233,234,238],{},[235,236,237],"td",{},"Mint invite token, hash + expiry in Postgres",[235,239,240],{},"Library",[220,242,243,246],{},[235,244,245],{},"Branding, email provider, copy",[235,247,248,249,252],{},"Host (",[205,250,251],{},"on_after_invite"," \u002F mail intent)",[220,254,255,258],{},[235,256,257],{},"Accept link + set password",[235,259,260,261],{},"Client → ",[205,262,263],{},"POST …\u002Fauth\u002Faccept-invite",[198,265,266,267,270],{},"Invite tokens are SHA-256 hashed at rest. Default expiry: 7 days\n(",[205,268,269],{},"invite_token_expire_days","). Works with SimpleRBAC and EnterpriseRBAC.",[272,273],"hr",{},[275,276,278],"h2",{"id":277},"endpoints","Endpoints",[198,280,281,282,285,286,289,290,293],{},"Mount ",[205,283,284],{},"get_auth_router"," and ",[205,287,288],{},"get_users_router"," (examples use ",[205,291,292],{},"\u002Fv1","):",[214,295,296,308],{},[217,297,298],{},[220,299,300,303,306],{},[223,301,302],{},"Action",[223,304,305],{},"Method + path",[223,307,61],{},[230,309,310,325,338],{},[220,311,312,315,320],{},[235,313,314],{},"Create invite",[235,316,317],{},[205,318,319],{},"POST \u002Fv1\u002Fauth\u002Finvite",[235,321,322],{},[205,323,324],{},"user:create",[220,326,327,330,335],{},[235,328,329],{},"Accept invite",[235,331,332],{},[205,333,334],{},"POST \u002Fv1\u002Fauth\u002Faccept-invite",[235,336,337],{},"Public",[220,339,340,343,348],{},[235,341,342],{},"Resend invite",[235,344,345],{},[205,346,347],{},"POST \u002Fv1\u002Fusers\u002F{user_id}\u002Fresend-invite",[235,349,350],{},[205,351,352],{},"user:update",[198,354,355,356,359,360,364,365,368],{},"Create\u002Fresend return ",[205,357,358],{},"UserResponse"," — the plaintext token is ",[361,362,363],"strong",{},"not"," in the JSON\nbody; it goes to the host delivery hook. Accept returns ",[205,366,367],{},"LoginResponse",".",[272,370],{},[275,372,46],{"id":373},"configuration",[375,376,381],"pre",{"className":377,"code":378,"language":379,"meta":380,"style":380},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","auth = SimpleRBAC(\n    database_url=...,\n    secret_key=...,\n    enable_invitations=True,       # default — surfaced on GET \u002Fauth\u002Fconfig\n    invite_token_expire_days=7,\n)\n","python","",[205,382,383,391,397,403,409,415],{"__ignoreMap":380},[384,385,388],"span",{"class":386,"line":387},"line",1,[384,389,390],{},"auth = SimpleRBAC(\n",[384,392,394],{"class":386,"line":393},2,[384,395,396],{},"    database_url=...,\n",[384,398,400],{"class":386,"line":399},3,[384,401,402],{},"    secret_key=...,\n",[384,404,406],{"class":386,"line":405},4,[384,407,408],{},"    enable_invitations=True,       # default — surfaced on GET \u002Fauth\u002Fconfig\n",[384,410,412],{"class":386,"line":411},5,[384,413,414],{},"    invite_token_expire_days=7,\n",[384,416,418],{"class":386,"line":417},6,[384,419,420],{},")\n",[198,422,423,208,426,429],{},[205,424,425],{},"GET \u002Fv1\u002Fauth\u002Fconfig",[205,427,428],{},"features.invitations"," for UI show\u002Fhide.",[431,432,433],"warning",{},[198,434,435,438],{},[205,436,437],{},"enable_invitations=False"," currently hides the feature in config \u002F",[440,441,442],"blockquote",{},[198,443,444],{},"UI discovery. Invite HTTP routes remain registered — treat the flag as a\nproduct switch.",[272,446],{},[275,448,450],{"id":449},"flow","Flow",[375,452,457],{"className":453,"code":455,"language":456},[454],"language-text","Admin POST \u002Fv1\u002Fauth\u002Finvite\n  → User INVITED (no password)\n  → Host gets plaintext token once (mail intent \u002F on_after_invite)\n  → Host emails accept URL + token\nUser POST \u002Fv1\u002Fauth\u002Faccept-invite { token, new_password }\n  → ACTIVE + LoginResponse (access + refresh)\n","text",[205,458,455],{"__ignoreMap":380},[198,460,461,462,465],{},"On accept: password stored, ",[205,463,464],{},"email_verified=true",", invite token fields cleared.",[272,467],{},[275,469,471,472,475],{"id":470},"invite-payload-inviteuserrequest","Invite payload (",[205,473,474],{},"InviteUserRequest",")",[214,477,478,491],{},[217,479,480],{},[220,481,482,485,488],{},[223,483,484],{},"Field",[223,486,487],{},"Required",[223,489,490],{},"Notes",[230,492,493,505,521,533,552],{},[220,494,495,500,503],{},[235,496,497],{},[205,498,499],{},"email",[235,501,502],{},"Yes",[235,504],{},[220,506,507,516,519],{},[235,508,509,512,513],{},[205,510,511],{},"first_name"," \u002F ",[205,514,515],{},"last_name",[235,517,518],{},"No",[235,520],{},[220,522,523,528,530],{},[235,524,525],{},[205,526,527],{},"is_superuser",[235,529,518],{},[235,531,532],{},"Only current superusers may set",[220,534,535,540,542],{},[235,536,537],{},[205,538,539],{},"role_ids",[235,541,518],{},[235,543,544,545,548,549,551],{},"Without ",[205,546,547],{},"entity_id",": direct roles. With ",[205,550,547],{},": roles on that membership",[220,553,554,558,560],{},[235,555,556],{},[205,557,547],{},[235,559,518],{},[235,561,562],{},"Enterprise membership (needs membership service)",[198,564,565,568,569,572,573,576,577,580],{},[361,566,567],{},"Accept"," (",[205,570,571],{},"AcceptInviteRequest","): ",[205,574,575],{},"token",", ",[205,578,579],{},"new_password"," (length policy enforced).",[198,582,583,586,587,590],{},[361,584,585],{},"Resend:"," only for ",[205,588,589],{},"status=invited","; invalidates the previous token.",[272,592],{},[275,594,596],{"id":595},"host-delivery","Host delivery",[198,598,599,600,603,604,568,607,610,611,368],{},"Library mints tokens; ",[361,601,602],{},"you"," brand and send. Recommended path:\n",[205,605,606],{},"outlabs_auth.mail",[205,608,609],{},"ComposedAuthMailService",", composers, SMTP \u002F SendGrid \u002F\nMailgun \u002F Postmark \u002F Resend \u002F webhook providers). Runnable:\n",[205,612,613],{},"examples\u002Fenterprise_rbac\u002Ftransactional_mail.py",[198,615,616,617,619,620,368],{},"Also: ",[205,618,251],{}," hook if you already own delivery outside the mail\nhelpers. See ",[621,622,82],"a",{"href":83},[272,624],{},[275,626,628],{"id":627},"related","Related",[630,631,632,637,641,645],"ul",{},[633,634,635],"li",{},[621,636,112],{"href":113},[633,638,639],{},[621,640,92],{"href":93},[633,642,643],{},[621,644,82],{"href":83},[633,646,647,649],{},[621,648,149],{"href":150}," — invite UX for Simple vs Enterprise",[651,652,653],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":380,"searchDepth":387,"depth":393,"links":655},[656,657,658,659,661,662],{"id":277,"depth":393,"text":278},{"id":373,"depth":393,"text":46},{"id":449,"depth":393,"text":450},{"id":470,"depth":393,"text":660},"Invite payload (InviteUserRequest)",{"id":595,"depth":393,"text":596},{"id":627,"depth":393,"text":628},"Invite-by-email onboarding.","md",null,{},{"icon":100},{"title":97,"description":663},"osBU704BsYcnvLzjOYTOErKzDiEYmhFQfZ-94lQF2zw",[671,673],{"title":92,"path":93,"stem":94,"description":672,"icon":95,"children":-1},"Admin and self-service user HTTP surface.",{"title":102,"path":103,"stem":104,"description":674,"icon":105,"children":-1},"Permission catalog and role definitions.",1787472745731]