Create an invited account (public)

The "create account and join" half of the /invite/{token} form, no session required, because the visitor is about to establish their first one. Creates the account with its email already confirmed, then the browser signs in with the same password and goes on to POST /api/invites/accept.

Skipping the confirmation email is the reason this route exists rather than a shortcut taken around one: holding the token means having opened the message sent to the invite's address, so it is already proven, on the same bearer-capability reasoning that lets /invite/{token} be viewed with no auth and lets resend be honoured on a token alone. A second confirmation round-trip proves nothing the token did not.

The address is read off the invite row and never off the body; a token is authority over exactly one address, and honouring a caller-supplied one would turn a leaked invite into a create-an-account-anywhere primitive.

Replaced a browser-side supabase.auth.signUp(), which could not work here: with confirmations enabled GoTrue answers an already-registered address with a session-less 200 and no error at all (enumeration protection) and sends no mail, so the form's only remaining branch was to strand a returning invitee on "check your email" for a message that was never coming. The admin API does not obfuscate, which is what makes the 409 below possible.

Response BodyCopy Anchor Link

curl -X POST "https://example.com/api/invites/register" \  -H "Content-Type: application/json" \  -d '{    "token": "string",    "password": "string"  }'

{  "ok": true}