Implement invite-only SaaS

Invite-only signup caps growth to whoever you hand a code or token to - a private beta, a launch list you admit by hand, any product that wants qualified users before strangers.

Turn on invite-only mode

Set the tenant’s registration mode to invite-only (registration_mode: 'INVITE_ONLY', under Settings → Authentication - see Registration modes). This is enforced at the API level - even a request that bypasses your frontend entirely still needs a valid token or code.

Create codes/tokens (server-side)

import { Kerne } from '@kerne/server';
const kerne = new Kerne({ appId, secretKey });

// A reusable code (share it in a launch email, a landing page, etc.)
// maxUses defaults to 1 (single-use) - raise it for a code meant for many people, up to 1,000.
const { code, expiresAt } = await kerne.invitations.createCode({
  expiresAt: '2026-12-31T23:59:59.000Z', // omit for no expiry
  maxUses: 500,
});

// Or a token tied to one specific email
const { token } = await kerne.invitations.createToken({ email: '[email protected]' });

The code string itself is server-generated - you never pick it yourself.

Signup with the code (client-side)

import { useAuth } from '@kerne/react';

function SignupForm() {
  const { register } = useAuth();

  const handleSignup = async (data: { email: string; password: string; code: string }) => {
    try {
      await register({
        email: data.email,
        password: data.password,
        invitationCode: data.code,
      });
    } catch (err) {
      // K1004: invalid, expired, or already-used code
    }
  };
}

You can validate a code up front (before showing the rest of the signup form) with kerne.invitations.validateCode(code) - a public route, no auth required.

Pitfalls to avoid

“Account already exists.” If someone with an invite code already has an account, K1008 (email taken) is what you’ll see - route that to “log in instead”, not a generic failure message. Lost invites. There’s no resend() method today - re-sending means creating a new token/code and emailing it yourself. Track which emails you’ve already invited so you don’t accidentally issue duplicates.

Quick starts

Common tasks

Implement invite-only SaaS

Pitfalls to avoid

​Pitfalls to avoid

Pitfalls to avoid