> ## Documentation Index > Fetch the complete documentation index at: https://spreecommerce.org/docs/llms.txt > Use this file to discover all available pages before exploring further. # Accept an invitation > Accepts a staff invitation and returns a signed-in admin session, so the new member lands in the dashboard rather than on a login form. Unauthenticated — the ID and token in the emailed link are the credential. The email is never taken from the request; it always comes from the invitation. `password` is required when no account exists for the invited address, in which case it sets one. When an account already exists, the same field is how the person proves the account is theirs. ## OpenAPI ````yaml /api-reference/admin.yaml post /api/v3/admin/auth/invitations/{id}/accept openapi: 3.0.3 info: title: Admin API contact: name: Spree Commerce url: https://spreecommerce.org email: hello@spreecommerce.org description: > Spree Admin API v3 - Administrative API for managing products, orders, and store settings. ## Authentication The Admin API requires a secret API key passed in the `x-spree-api-key` header. Secret API keys can be generated in the Spree admin dashboard. ## Response Format All responses are JSON. List endpoints return paginated responses with `data` and `meta` keys. Single resource endpoints return a flat JSON object. ## Resource IDs Every resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`, `variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths, request bodies, and Ransack filters all accept them directly. ## Error Handling Errors return a consistent format: ```json { "error": { "code": "validation_error", "message": "Validation failed", "details": { "name": ["can't be blank"] } } } ``` version: v3 servers: - url: http://{defaultHost} variables: defaultHost: default: localhost:3000 security: [] tags: - name: Authentication description: Admin user login, logout, token refresh, and current user profile - name: Allowed Origins description: CORS allowlist for storefront and admin client origins - name: API Keys description: Secret and publishable API keys - name: Categories description: >- Hierarchical product categories — tree management, repositioning, and product assignments - name: Channels description: >- Sales channels, product publication across channels, and per-channel order routing rules - name: Custom Fields description: >- Custom field definitions for products, variants, customers, and other resources - name: Customer Groups description: >- Customer groups for segmenting customers (e.g. wholesale, VIP) used by pricing and promotions - name: Customers description: Customer profiles, addresses, credit cards, and store credits - name: Email Templates description: >- Customer email templates, the email layout and shared partials: drafts, previews, publishing and history - name: Exports description: Async CSV exports of admin resources - name: Files description: Uploading the files that product media, imports, logos and documents use - name: Fulfillments description: Order fulfillments — shipments, fulfill, cancel, resume, split - name: Gift Cards description: Gift cards and gift card batches - name: Imports description: >- Async CSV imports of admin resources, with per-row status and failed-row retry - name: Markets description: >- Markets — geographic groupings of countries used for pricing, tax, and fulfillment rules - name: Option Types description: >- Option types and option values used to build product variants (e.g. Size, Color) - name: Orders description: Orders, order items, applied gift cards, and applied store credits - name: Payment Methods description: Configured payment providers and their available types - name: Payments description: Order payments — list, capture, void - name: Pricing description: >- Prices and price lists for currency-, market-, and customer-group-specific pricing - name: Products description: >- Products, taxons/categories, product custom field values, and bulk product operations - name: Policies description: The store's legal documents — terms of service, privacy, returns, shipping - name: Reasons description: >- Merchant-owned vocabularies for why a return, claim, refund, cancellation or tax exemption happened - name: Promotions description: Promotions, promotion rules, promotion actions, and coupon codes - name: Refunds description: Order refunds - name: Settings description: Store-level settings — store profile, tags, and configuration - name: Staff description: Admin users, roles, and invitations to the store - name: Stock Locations description: Warehouses and physical fulfillment locations - name: Store Credits description: Prepaid customer balances across all customers, and each balance's ledger - name: Variants description: >- Product variants — the individual SKUs (size/color combinations) sold under a product - name: Webhooks description: Webhook endpoints and webhook delivery history paths: /api/v3/admin/auth/invitations/{id}/accept: parameters: - name: id in: path description: Invitation ID from the emailed link required: true schema: type: string post: tags: - Authentication summary: Accept an invitation description: | Accepts a staff invitation and returns a signed-in admin session, so the new member lands in the dashboard rather than on a login form. Unauthenticated — the ID and token in the emailed link are the credential. The email is never taken from the request; it always comes from the invitation. `password` is required when no account exists for the invited address, in which case it sets one. When an account already exists, the same field is how the person proves the account is theirs. parameters: - name: token in: query required: true description: The token from the emailed link schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/InvitationAcceptParams' required: true responses: '200': description: invitation accepted, session issued content: application/json: example: token: >- eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoyLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6IjQ2MzZlMDBiLTdmZGMtNDk1Mi1hNzhhLTI4YmEyMTVjNDk0MSIsImlzcyI6InNwcmVlIiwiYXVkIjoiYWRtaW5fYXBpIiwiZXhwIjoxNzY4NDc4NzAwfQ.AwpPaRCvRIV36C8k4nChul5s7yq_yWFTSy_TyVlrbXA user: id: adm_gbHJdmfrXB email: newcomer@acme.test first_name: Robin last_name: Ellis full_name: Robin Ellis selected_locale: null created_at: '2026-01-15T12:00:00.000Z' updated_at: '2026-01-15T12:00:00.000Z' avatar_url: null roles: - id: role_UkLWZg9DAJ name: admin stores: - id: store_UkLWZg9DAJ name: Spree Test Store code: spree_1 schema: $ref: '#/components/schemas/AuthResponse' '404': description: wrong token, or an invitation that can no longer be accepted content: application/json: example: error: code: record_not_found message: Invitation not found, expired, or already accepted schema: $ref: '#/components/schemas/ErrorResponse' x-codeSamples: - lang: javascript label: Spree Admin SDK source: >- import { createAdminClient } from '@spree/admin-sdk' const client = createAdminClient({ baseUrl: 'https://your-store.com', secretKey: 'sk_xxx', }) // The invitation ID and token come from the link in the invitation email. // An invitee without an account sets a password here; one with an account // signs in with theirs. The refresh token is set as an HttpOnly cookie. const auth = await client.auth.acceptInvitation('inv_UkLWZg9DAJ', 'xK3pQ9vLmT2wRz8N', { password: 'password123', password_confirmation: 'password123', first_name: 'Robin', last_name: 'Ellis', }) - lang: bash label: Spree CLI source: >- spree api post /auth/invitations/{id}/accept -d '{"password":"password123","password_confirmation":"password123","first_name":"Robin","last_name":"Ellis"}' components: schemas: InvitationAcceptParams: type: object properties: password: type: string description: >- Required when the invitee has no account yet: it creates one. An existing account signs in without it. password_confirmation: type: string first_name: type: string last_name: type: string AuthResponse: type: object properties: token: type: string description: JWT access token user: $ref: '#/components/schemas/AdminUser' required: - token - user ErrorResponse: type: object properties: error: type: object properties: code: type: string example: record_not_found message: type: string example: Record not found details: type: object description: Field-specific validation errors nullable: true example: name: - is too short - is required email: - is invalid required: - code - message required: - error example: error: code: validation_error message: Validation failed details: name: - is too short email: - is invalid AdminUser: type: object properties: id: type: string email: type: string first_name: type: string nullable: true last_name: type: string nullable: true full_name: type: string nullable: true selected_locale: type: string nullable: true created_at: type: string updated_at: type: string avatar_url: type: string nullable: true roles: type: array items: $ref: '#/components/schemas/AdminUserRoleAssignment' stores: type: array items: $ref: '#/components/schemas/AdminUserStore' required: - id - email - first_name - last_name - full_name - selected_locale - created_at - updated_at - avatar_url - roles - stores x-typelizer: true AdminUserRoleAssignment: type: object description: A role assignment for the current store on a staff member properties: id: type: string description: Prefixed role ID example: role_abc123 name: type: string description: Role name example: admin required: - id - name AdminUserStore: type: object description: A store the staff member can access through a role assignment properties: id: type: string description: Prefixed store ID example: store_abc123 name: type: string description: Store name example: My Store code: type: string description: Store code example: my-store required: - id - name - code ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.