Guide
Team Invitations
Developer team invitations use cryptographically random one-time tokens, SHA-256 token hashes, expiration, revocation, invited-email binding, replay protection, and audit logging.
SoundSync
Invitation lifecycle
Invitation acceptance is transactional and creates membership only for the authenticated invited email.
| Step | platform behavior |
|---|---|
| Create | Normalizes email, rejects active members, revokes superseded pending invitations, validates role and product scope, hashes token, sends transactional email, writes audit. |
| Accept | Hashes raw token, locks pending invitation, checks status, expiration, invited email, replay, existing membership, creates member/product mappings, marks accepted, writes audit. |
| Revoke | Requires team.invite, workspace-scopes invitation ID, revokes pending invitation, writes audit. |