# Clerk organization invitation and acceptance flow

## Sending

1. Only admins can invite by default. Confirm the inviter's role before
   showing an invite form, or the call fails for members.
2. Email must be enabled for the instance (Configure, User and
   authentication), because Clerk sends the invitation by email. If email is
   off entirely, skip invitations and add existing users directly with the
   create organization membership backend call, which needs their Clerk
   user id.
3. When creating the invitation through the backend API, pass a redirect_url.
   Without it the invitee lands on the Account Portal sign-in page instead
   of your app.
4. Add your accept page to the allowed redirect URLs (Configure, General)
   or the redirect is refused.

## Accepting

The invitee lands on your redirect URL with two query params appended:
__clerk_ticket (the ticket value) and __clerk_status (the outcome).

- sign_up: the user does not exist yet. Build a sign-up flow and pass the
  ticket into signUp.create so the account is created already attached to
  the org.
- sign_in: the user exists but is not signed in. Pass the ticket into
  signIn.create with the ticket strategy.
- complete: the user existed and was signed in. Nothing more to do.

## Checklist

- Test all three statuses, not just the sign-up one. Most teams only test
  the new-user path and ship a broken flow for existing users.
- Revoke stale invitations from the org members page; an old ticket for a
  departed hire should not linger.
- The invited role comes from the invitation, not from the default role.
  Verify the role on the membership after acceptance, especially if you
  pre-filled a privileged role.