Joining a company
This is the final confirmation step when someone has been invited to join an existing production company. By the time they reach this page, they’re already signed in (either they had an account already, or they just created one via the Registering via an invitation link flow). All that’s left is to confirm and accept.
What happens
Section titled “What happens”The user lands on this page via a link in an invitation email (with ?token=… in the URL). The app:
- Checks the URL token
- Verifies the user is signed in (if not, prompts them to log in or create an account)
- Shows a confirmation dialog
- On confirm, calls the backend to associate the user with the company
- Removes the token from the URL (so it can’t be re-used or leaked through browser history)
- Redirects to the projects list
The confirmation step exists for security: it prevents the association from happening just because someone clicked a malicious link.
What the user sees
Section titled “What the user sees”The page shows different things depending on the user’s state:
| Situation | What’s shown |
|---|---|
| URL has no token / invalid token | Error: auth.RegisterCompanyUser.no-invitation-token |
| Token is valid, user not signed in | A panel offering “Create account” or “Log in”, with the email pre-filled where possible |
| Token is valid, user signed in | A confirmation dialog with title auth.RegisterCompanyUser.confirm-invitation, description auth.RegisterCompanyUser.confirm-invitation-description, and an “Accept invitation” button (auth.RegisterCompanyUser.accept-invitation) |
| Processing | Spinner with auth.RegisterCompanyUser.linking-invite |
| Success | Success icon + auth.RegisterCompanyUser.association-success; auto-redirects to projects after 2 seconds |
| Failure | Error icon + auth.RegisterCompanyUser.association-failed (deliberately generic to avoid leaking info about whether the token was valid, etc.) |
What you can customise
Section titled “What you can customise”Translations
Section titled “Translations”All page text lives under auth.RegisterCompanyUser.* in tep-configuration/translations/{locale}/main/auth.json. Override per client in clients/{client}/translations/{locale}/overrides.json.
The invitation email
Section titled “The invitation email”The invitation email itself is sent by your app (not by Ory), using the company-user-invite email template. Per-client variants can be supplied as {client}-company-user-invite.mjml.
Variations for your deployment
Section titled “Variations for your deployment”The flow is the same across all clients. The only thing that varies is the branding of the invitation email and the translations of the on-page text.
Need more detail?
Section titled “Need more detail?”For the URL-sanitisation pattern, the state machine, and the security considerations, see Joining a company (engineering).