# Organization errors
## The errors
- `{"error": "access_denied", "error_description": "Organization is required"}` or the login page shows an organization picker unexpectedly.
- `invalid_request`: the organization parameter was malformed.
- Invitation link errors: "Invitation not found", "already accepted", or the invitee lands in the wrong org.
## org_id vs org_name
The `organization` authorize parameter accepts either the org_id (`org_abc123`) or the organization name. Names are human-readable and can change; ids are stable. Prefer org_id in code. When using `{organization_name}` placeholders in callback URLs, the name must match exactly, including casing.
## Required organization
Dashboard > Organizations > your org, or the application settings, can require an organization for login. If required and the authorize call omits `organization`, login fails. Fix: pass `organization: org_xxx` in authorizationParams on every login call, or turn off the requirement if the app is multi-mode.
## Invitation failures
- Expired: invitations expire after 7 days by default. Resend from Dashboard > Organizations > Members > Invite.
- Wrong user: the invitation is tied to an email. If the invitee logs in with a different email or a social account with a different email, acceptance fails. The invited email must match the login identity.
- Already a member: re-inviting an existing member errors; check membership first.
- Connection mismatch: the invite specifies a connection; the user must authenticate through that connection.
## Just-in-time membership
Instead of invites, enable JIT: Organization > Connections > enable connection > turn on Just-In-Time membership. Users logging in through that connection auto-join. Fewer invites, fewer failures.
## Checklist
- organization param passed consistently (id form) on every login and silent-auth call.
- Invitation email matches the login identity; resend if expired.