FEATURES
Team
Invite teammates, manage members, and accept invitations. Delivered as the team service (@startupcore/team) with HTTP API, SDK, and React components.
Overview
Invite teammates, manage members, and accept invitations. Delivered as the team service (@startupcore/team) with HTTP API, SDK, and React components.
Who should use this
Multi-user tenants onboarding developers, billing managers, and viewers.
Core concepts
Invitations use secure tokens (hashed at rest). Accept flow binds the signed-in user email to the invite. Feature key team gates all member APIs.
Setup
POST /tenants/{tenantId}/invitations → email queued via worker → invitee opens /invite/{token} → POST /invitations/{token}/accept.
Required entitlement
team (included on Free plan and above).
Required permissions
tenant.members.view, tenant.members.invite, tenant.members.update.
REST API
GET/POST /invitations, POST .../revoke, GET /invitations/{token}, POST /invitations/{token}/accept, GET/PATCH /members.
SDK (@startupcore/api-client)
startupCore.organizations.listInvitations, .createInvitation, .revokeInvitation, .getInvitationByToken, .acceptInvitation, .listMembers, .updateMemberRole.
React components
<InviteMemberForm />, <PendingInvitationsTable />, <MemberRoleTable /> from @startupcore/rbac-react.
Security notes
Tokens are single-use; invitation email must match Cognito email on accept.
Troubleshooting
403 on accept — sign in with the invited email. 410 — invitation expired (7 days).