Invite
Secure, reusable, single-use invitation lifecycles for Convex applications.
git clone https://github.com/dciccale/convex-invite.git
cd convex-inviteThis upstream package has not been adapted or qualified for Bijection. Read the original documentation before adopting it.
Description
Secure, reusable, single-use invitation lifecycles for Convex applications.
Explore the package README for API concepts, configuration, and examples. Check the Bijection source for adaptation-specific setup.
Review the source and its dependencies before adopting this package. Source availability does not establish npm publication or runtime qualification.
Getting started
- Get the source at the revision above and read its package documentation.
- Check the required Bijection SDK version, dependencies, and external service credentials.
- Follow the package setup instructions and the guide to using components.
- Exercise the component in your deployment according to your project’s verification rules.
Open source
Maintained source: dciccale/convex-invite. License: See repository. Consult the repository for license terms, notices, and contributor attribution.
From the upstream publisher
Secure, reusable, single-use invitation lifecycles for Convex.
Explore the demo ↗Upstream overview
From the upstream package documentation.
convex-invite provides a secure invitation state machine for Convex applications. It generates 256-bit bearer tokens, stores only SHA-256 digests, and enforces single-use lifecycle transitions, audience binding, expiry, revocation, resend replacement, and idempotent acceptance. Host applications keep control of authentication, authorization, delivery, and domain grants.
Use cases
From the upstream package documentation.
- Add invite-only onboarding with single-use, cryptographically secure tokens
- Invite members to teams, workspaces, projects, or other host-owned resources
- Bind acceptance to an authenticated user with a verified email or other audience reference
- Rotate invitation links safely through atomic resend replacement
- Integrate an existing email provider, including @convex-dev/resend, while keeping delivery separate from authorization
How it works
From the upstream package documentation.
Install the package, mount it in convex/convex.config.ts, and construct an Invitations client with the generated component mount. Lifecycle write methods require a Convex mutation context. This lets invitation acceptance and the host application's membership or domain grant commit in one transaction.
The component returns a raw token only from issue and resend. It stores a versioned SHA-256 digest instead of the token. The host sends the raw token through its chosen delivery provider and must not log or persist it. The provider-neutral withDelivery helper can wrap an existing provider client and records safe queued or failed delivery metadata.
When a user accepts an invitation, the host verifies authentication and audience ownership. In one mutation, it calls accept, writes the host grant, and stores an idempotent acceptance result. The component also supports decline, revocation, effective expiry, bounded pruning, management queries, and atomic resend replacement.
Upstream package FAQ
What does convex-invite actually store in the Convex database?
convex-invite stores only the hash of each invitation token, not the plaintext value. The component owns the hash-only tokens and the invitation state machine. This means a database breach does not expose usable invitation links.
Who is responsible for sending invitation emails when using convex-invite?
The host application retains full ownership of delivery. convex-invite defines a webhook contract and documents an optional integration with @convex-dev/resend, but the component itself does not send emails. This design lets you use any email provider or delivery mechanism without modifying the component.
Does convex-invite handle authentication or authorization?
No. convex-invite explicitly leaves authentication, authorization, audience verification, delivery, and domain grants to the host application. The component is responsible only for token hashing and the invitation state machine, which keeps its responsibilities narrow and composable.
How do I install and add convex-invite to a Convex project?
Install the package with npm install convex-invite, then integrate the publishable Convex component and typed host client from the packages/convex-invite workspace into your Convex backend. The repository includes an example app under apps/example that demonstrates a full secure integration with atomic membership creation.
Are invitations single-use or can they be reused?
convex-invite enforces single-use semantics through its invitation state machine. Once a token is redeemed, the component transitions the invitation to a consumed state so the same token cannot be used again. The README describes the component as managing secure, reusable invitation lifecycles, meaning the pattern is reusable across your application while each individual token is single-use.
Use with agents and CLI
Give your coding agent the component’s source identity and setup guidance.
Help me integrate Invite with Bijection.
Read: https://bijection.com/components/convex-invite/SKILL.md
Check SDK compatibility and dependency availability.
Follow this project's execution and verification rules.Upstream README.md
View repository ↗Documentation from dciccale/convex-invite, recorded October 23, 2026. APIs and setup may differ in the Bijection adaptation.
convex-invite
Secure, reusable invitation lifecycles for Convex applications.
This repository is a Bun workspace managed with Turborepo and Biome.
Workspace
packages/convex-invite— publishable Convex component and typed host client.apps/example— secure host integration with delivery and atomic membership creation.apps/web— product site and documentation.docs/delivery.md— delivery ownership, the example webhook contract, and an optional@convex-dev/resendintegration.
Development
bun install
bun run dev:web
bun run check
bun run verify:package
The component owns hash-only invitation tokens and the invitation state machine. Host applications retain authentication, authorization, audience verification, delivery, and domain grants.