Org invitations

Add a member to your organization by sending them a link. The recipient clicks → previews the invite → accepts → lands inside the org. Works whether they already have a stech account or not.

Inviting #

Invitations live on /settings/members. Owner / admin only.

Click invite member:

Role — member (default) or admin. Owners can also invite as owner; the receiving member becomes a co-owner on accept.
Email (optional) — when set, the api sends the invite link to that address via Resend (shares setup with magic-link sign-in). When left blank, you get a shareable link to copy and send out-of-band (Slack DM, etc.). An invite with an email requires that recipient's account; an invite without an email can be accepted by any signed-in link holder.

Shared invitation links inherit the app's generic preview. Their social metadata contains no invitation token, recipient details, or company information. Invitation pages request noindex, nofollow, even when a link has expired.

Pending invitations show below the members table with their role, target email (if any), expiry, and a revoke button.

Lifetime #

Expiry — 7 days from creation. Expired invitations stop accepting and auto-hide from the list.
Single-use accept — the token is consumed atomically with the membership insert; double-clicking the link can't double-add.
Revoke — owner / admin can revoke any pending invite. Revoked links 410 immediately on the next click.

Accepting (the invitee's side) #

The link points at /invite/<token>. The page previews the org name and the role being offered without requiring sign-in, so the recipient can see what they're walking into.

Three caller states, all handled by a single accept button:

Already signed in to stech — accept inserts the membership and bounces to /<orgSlug>/agents.
Has an account, signed out — accept redirects to /sign-in?next=… with a continuation back to the accept page; sign in (password or magic-link) and the original accept resumes.
No account yet — same shape but via /sign-up instead. Account is created, membership is added, you're in.

The signed-in account's email must match an email-addressed invitation (case-insensitive, ignoring surrounding whitespace). A different account receives instructions to sign out and use the intended email; the invite remains pending. Email-free shareable links retain their existing behavior.

Organizations connected to Maestro #

An invitation does not grant membership in Maestro. For a connected organization, the recipient must also belong to that same organization in Maestro and link their Maestro account to their signed-in Stech account. Ask the organization's administrator to add the recipient in Maestro if needed.

If Maestro access cannot be verified, accept returns 403 maestro_access_required without consuming the invitation or changing membership. The page keeps an explanation visible and offers Connect Maestro and return, using the existing Maestro linking page with a local return path to the invitation. After connecting, the recipient returns and explicitly accepts again; there is no automatic accept. Maestro's existing membership synchronization can add a local Stech member, but accepting a Stech invitation never creates a Maestro account or membership.

Standalone Stech organizations continue to use the normal invitation flow.

CLI #

stech members covers list / role-change / remove today. CLI invite parity (stech members invite <email>) is on the roadmap; for now, issue invitations from the dashboard.

Magic-link sign-in — the same Resend pipeline ships invitation emails.