---
name: bijection-convex-invite
description: "Evaluate and integrate the Invite component with Bijection."
---

# Invite

Secure, reusable, single-use invitation lifecycles for Convex applications.

This is an upstream package. It has not been adapted or qualified for Bijection.

- Package: convex-invite
- Source: https://github.com/dciccale/convex-invite
- npm: https://www.npmjs.com/package/convex-invite
- Directory: https://bijection.com/components/convex-invite

Read the upstream README for setup, license, and compatibility before using it.

## Integration workflow

1. Read the source README and package manifest at the recorded revision.
2. Confirm the required SDK, dependency availability, and runtime compatibility.
3. Follow the component's documented setup and configuration. Never invent an npm install command from a catalog package name.
4. Keep credentials in the project's existing secret store.
5. Follow the project's execution rules for verification and report what was actually checked.

## Original upstream skill

The following guidance describes convex-invite. Its installation commands and APIs refer to the upstream package. Evaluate compatibility with the Bijection source separately.


> Agents: read this skill fully before writing code that uses Invite. Follow the installation and configuration steps exactly.

# Invite

## Instructions

convex-invite provides a secure invitation state machine for Convex applications. It generates 256-bit bearer tokens, stores only SHA-256 digests, and enforces single-use lifecycle transitions, audience binding, expiry, revocation, resend replacement, and idempotent acceptance. Host applications keep control of authentication, authorization, delivery, and domain grants.

### Installation

```bash
npm install convex-invite
```

Current npm version: `convex-invite@0.1.1`

## Use cases

- Add invite-only onboarding with single-use, cryptographically secure tokens
- Invite members to teams, workspaces, projects, or other host-owned resources
- Bind acceptance to an authenticated user with a verified email or other audience reference
- Rotate invitation links safely through atomic resend replacement
- Integrate an existing email provider, including @convex-dev/resend, while keeping delivery separate from authorization

## How it works

Install the package, mount it in convex/convex.config.ts, and construct an Invitations client with the generated component mount. Lifecycle write methods require a Convex mutation context. This lets invitation acceptance and the host application's membership or domain grant commit in one transaction.

The component returns a raw token only from issue and resend. It stores a versioned SHA-256 digest instead of the token. The host sends the raw token through its chosen delivery provider and must not log or persist it. The provider-neutral withDelivery helper can wrap an existing provider client and records safe queued or failed delivery metadata.

When a user accepts an invitation, the host verifies authentication and audience ownership. In one mutation, it calls accept, writes the host grant, and stores an idempotent acceptance result. The component also supports decline, revocation, effective expiry, bounded pruning, management queries, and atomic resend replacement.

## When NOT to use

- When a simpler built-in solution exists for your specific use case
- If you are not using Convex as your backend
- When the functionality provided by Invite is not needed

## Resources

- [npm package](https://www.npmjs.com/package/convex-invite)
- [GitHub repository](https://github.com/dciccale/convex-invite)
- [Live demo](https://github.com/dciccale/convex-invite/tree/main/apps/example)
- [Convex Components Directory](https://www.convex.dev/components/convex-invite)
- [Convex documentation](https://docs.convex.dev)