Accept an invitation

Accepts a staff invitation and returns a signed-in admin session, so the new member lands in the dashboard rather than on a login form.

Unauthenticated — the ID and token in the emailed link are the credential. The email is never taken from the request; it always comes from the invitation.

password is required when no account exists for the invited address, in which case it sets one. When an account already exists, the same field is how the person proves the account is theirs — unless the request carries that account’s own access token, which proves it already.

POST

api

admin

auth

invitations

{id}

Spree Admin SDK

import { createAdminClient } from '@spree/admin-sdk'

const client = createAdminClient({
  baseUrl: 'https://your-store.com',
  secretKey: 'sk_xxx',
})

// The invitation ID and token come from the link in the invitation email.
// An invitee without an account sets a password here; one with an account
// signs in with theirs. The refresh token is set as an HttpOnly cookie.
const auth = await client.auth.acceptInvitation('inv_UkLWZg9DAJ', 'xK3pQ9vLmT2wRz8N', {
  password: 'password123',
  password_confirmation: 'password123',
  first_name: 'Robin',
  last_name: 'Ellis',
})

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoyLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6IjQ2MzZlMDBiLTdmZGMtNDk1Mi1hNzhhLTI4YmEyMTVjNDk0MSIsImlzcyI6InNwcmVlIiwiYXVkIjoiYWRtaW5fYXBpIiwiZXhwIjoxNzY4NDc4NzAwfQ.AwpPaRCvRIV36C8k4nChul5s7yq_yWFTSy_TyVlrbXA",
  "user": {
    "id": "adm_gbHJdmfrXB",
    "email": "newcomer@acme.test",
    "first_name": "Robin",
    "last_name": "Ellis",
    "full_name": "Robin Ellis",
    "selected_locale": null,
    "status": "active",
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z",
    "last_active_at": null,
    "avatar_url": null,
    "roles": [
      {
        "id": "role_UkLWZg9DAJ",
        "name": "admin"
      }
    ],
    "stores": [
      {
        "id": "store_UkLWZg9DAJ",
        "name": "Spree Test Store",
        "code": "spree_1"
      }
    ]
  }
}

{
  "error": {
    "code": "record_not_found",
    "message": "Invitation not found, expired, or already accepted"
  }
}

Path Parameters

string

required

Invitation ID from the emailed link

Query Parameters

token

string

required

The token from the emailed link

Body

application/json

password

string

Creates the account when the invitee has none yet. An existing account confirms it is theirs with it, unless the request is already signed in as that account.

password_confirmation

string

first_name

string

last_name

string

Response

invitation accepted, session issued

token

string

required

JWT access token

user

object

required

Show child attributes

⌘I

Spree Admin SDK

import { createAdminClient } from '@spree/admin-sdk'

const client = createAdminClient({
  baseUrl: 'https://your-store.com',
  secretKey: 'sk_xxx',
})

// The invitation ID and token come from the link in the invitation email.
// An invitee without an account sets a password here; one with an account
// signs in with theirs. The refresh token is set as an HttpOnly cookie.
const auth = await client.auth.acceptInvitation('inv_UkLWZg9DAJ', 'xK3pQ9vLmT2wRz8N', {
  password: 'password123',
  password_confirmation: 'password123',
  first_name: 'Robin',
  last_name: 'Ellis',
})

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoyLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6IjQ2MzZlMDBiLTdmZGMtNDk1Mi1hNzhhLTI4YmEyMTVjNDk0MSIsImlzcyI6InNwcmVlIiwiYXVkIjoiYWRtaW5fYXBpIiwiZXhwIjoxNzY4NDc4NzAwfQ.AwpPaRCvRIV36C8k4nChul5s7yq_yWFTSy_TyVlrbXA",
  "user": {
    "id": "adm_gbHJdmfrXB",
    "email": "newcomer@acme.test",
    "first_name": "Robin",
    "last_name": "Ellis",
    "full_name": "Robin Ellis",
    "selected_locale": null,
    "status": "active",
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z",
    "last_active_at": null,
    "avatar_url": null,
    "roles": [
      {
        "id": "role_UkLWZg9DAJ",
        "name": "admin"
      }
    ],
    "stores": [
      {
        "id": "store_UkLWZg9DAJ",
        "name": "Spree Test Store",
        "code": "spree_1"
      }
    ]
  }
}

{
  "error": {
    "code": "record_not_found",
    "message": "Invitation not found, expired, or already accepted"
  }
}

API basics

Endpoints

Accept an invitation

Path Parameters

Query Parameters

Body

Response