What an invited user actually receives

You have invited a colleague and they are asking what they are supposed to click. The short answer: they need a one-time invitation link, and that link takes them to a page that walks them through setting a password and an authenticator app in about five minutes. This article covers what you see when you send the invitation, what they see when they open the link, and what to do when a link does not work.

Sending the invitation

Go to Identity → Users and choose Invite. The dialog asks for four things — email address, first name, last name and role — for one person. There is no box for a list of addresses; one invitation is one colleague. See Inviting people one at a time, or in bulk if you have a spreadsheet of forty names.

Choose Send invite. The account record is created, a single-use invitation credential is minted against it, and the console immediately shows you the link.

The invitation link, and the one moment you can copy it

The dialog is headed with the address you invited:

It explains in plain words that the link is shown once, and that closing the dialog without keeping it means inviting the person again. It also tells you the two facts that matter about the link itself: it works exactly once, and it expires after 7 days.

What the dialog says next depends on how your deployment is set up, and it tells you which of the two applies rather than leaving you guessing:

Email delivery is configured

The same link has already been emailed to the person you invited, automatically, and the console says so. There is nothing else for you to do — though keeping the link until they have used it costs nothing and saves a re-invite if the message lands in a junk folder.

Email delivery is not configured

Nothing was sent, and the console says so and asks you to pass the link to the person yourself. Use a channel you already trust — in person, a phone call, your password manager's sharing feature. The link is a credential for the first few minutes of somebody's account: treat it like one, and do not post it in a shared channel that outlives it.

What your colleague sees

The link opens a public page — the address is /invite/ followed by the invitation code, and public here means they do not need to be signed in to reach it, which is rather the point, since they have no account to sign in with yet. The page is headed Join your team on Qorionix and takes them through three numbered steps.

1. 1

   Step 1 — choose a password and confirm their name

   The password must be at least 12 characters long and contain upper-case and lower-case letters, a number and a symbol. Their first and last name are shown as you typed them when inviting, and they can correct them here — worth mentioning to them, because it is easier for them to fix a misspelling now than for you to fix it afterwards.

2. 2

   Step 2 — set up an authenticator app

   A QR code is shown, which they scan with an authenticator app on their phone; if they cannot scan it, the same key is offered as text to enter by hand. They then type the 6-digit code the app produces, which is what confirms the app and their account agree. Two-factor authentication means a stolen password on its own is no longer enough to sign in as them — see Set up two-factor authentication for the same procedure written out at length, and for what happens if the phone is later lost.

3. 3

   Step 3 — save ten recovery codes

   They are shown ten one-time recovery codes and asked to save them somewhere safe. A tick-box acknowledging that they have done so is required before the final Go to the console button becomes available. Each code can stand in for a 6-digit code once, which is what gets them back in if the phone is lost. The codes are shown once and cannot be retrieved afterwards by anybody, including us, so this is the one screen in the flow worth pausing on.

When they choose Go to the console they are signed in, with the role you gave them. Nothing further is emailed to them and there is nothing else for you to do.

If the link does not work

A link that is invalid, has already been used, or has passed its 7 days shows a plain explanation saying so, and tells the person to ask whoever invited them to send a new one. There is nothing they can do from that page themselves — deliberately, because a stranger holding an expired link should not be able to talk the platform into issuing a fresh one.

• Already used — they have completed the flow and can simply sign in. If they cannot, that is a password problem rather than an invitation problem; see Resetting your own password.
• Expired — more than 7 days have passed since you sent it. Invite them again.
• Invalid — most often an older link from a previous invitation, or a link broken across two lines by an email client or a chat app. Ask them to copy the whole address in one piece, and if in doubt invite them again.

Re-inviting is the answer to all three. Open Identity → Users, choose Invite and enter the same details: a new link is issued and shown to you once, exactly as the first time, and the old one is dead the moment the new one exists.

What to do next

1. Tell the person on your usual internal channel that an invitation is coming, before you send it. An unexpected email asking somebody to create an account on a security platform looks exactly like a phishing attempt, and a well-trained colleague will delete it.
2. Read Set up two-factor authentication so you can answer the questions step 2 will produce.
3. For more than a handful of people, read Inviting people one at a time, or in bulk before you start.
4. Read Who actually needs a Qorionix account — most of your staff do not need one at all.