# Organization errors

## The errors

- `{"error": "access_denied", "error_description": "Organization is required"}` or the login page shows an organization picker unexpectedly.
- `invalid_request`: the organization parameter was malformed.
- Invitation link errors: "Invitation not found", "already accepted", or the invitee lands in the wrong org.

## org_id vs org_name

The `organization` authorize parameter accepts either the org_id (`org_abc123`) or the organization name. Names are human-readable and can change; ids are stable. Prefer org_id in code. When using `{organization_name}` placeholders in callback URLs, the name must match exactly, including casing.

## Required organization

Dashboard > Organizations > your org, or the application settings, can require an organization for login. If required and the authorize call omits `organization`, login fails. Fix: pass `organization: org_xxx` in authorizationParams on every login call, or turn off the requirement if the app is multi-mode.

## Invitation failures

- Expired: invitations expire after 7 days by default. Resend from Dashboard > Organizations > Members > Invite.
- Wrong user: the invitation is tied to an email. If the invitee logs in with a different email or a social account with a different email, acceptance fails. The invited email must match the login identity.
- Already a member: re-inviting an existing member errors; check membership first.
- Connection mismatch: the invite specifies a connection; the user must authenticate through that connection.

## Just-in-time membership

Instead of invites, enable JIT: Organization > Connections > enable connection > turn on Just-In-Time membership. Users logging in through that connection auto-join. Fewer invites, fewer failures.

## Checklist

- organization param passed consistently (id form) on every login and silent-auth call.
- Invitation email matches the login identity; resend if expired.