convex-invite manages secure, single-use invitation token lifecycles in Convex apps, handling state machines and hash storage while leaving auth and delivery to
npm install convex-inviteconvex-invite provides a secure invitation state machine for Convex applications. It generates 256-bit bearer tokens, stores only SHA-256 digests, and enforces single-use lifecycle transitions, audience binding, expiry, revocation, resend replacement, and idempotent acceptance. Host applications keep control of authentication, authorization, delivery, and domain grants.
convex-invite provides a Convex component that manages the full invitation lifecycle including token creation, validation, and expiration state. The host application handles user authentication and delivery, while the component enforces single-use semantics and stores only hashed tokens. This separation lets you wire in any email provider or delivery mechanism without changing the core invitation logic.
convex-invite owns hash-only invitation tokens and the invitation state machine within your Convex backend. You generate an invitation through the typed host client, deliver the token via your own mechanism, and validate it atomically when the invitee accepts. The component ensures tokens are single-use and tracks state transitions so you do not have to implement that logic yourself.
convex-invite is designed for exactly this pattern. The example app in the repository demonstrates secure host integration with delivery and atomic membership creation. The component handles token hashing and state, while the host application performs audience verification and grants domain-specific roles or memberships upon successful redemption.
convex-invite documents an optional integration with @convex-dev/resend through a delivery ownership model described in docs/delivery.md. The component defines an example webhook contract so the host application can send invitation emails via Resend or any other provider while the component remains responsible only for token state.
convex-invite stores only the hash of each invitation token, not the plaintext value. The component owns the hash-only tokens and the invitation state machine. This means a database breach does not expose usable invitation links.
The host application retains full ownership of delivery. convex-invite defines a webhook contract and documents an optional integration with @convex-dev/resend, but the component itself does not send emails. This design lets you use any email provider or delivery mechanism without modifying the component.
No. convex-invite explicitly leaves authentication, authorization, audience verification, delivery, and domain grants to the host application. The component is responsible only for token hashing and the invitation state machine, which keeps its responsibilities narrow and composable.
Install the package with npm install convex-invite, then integrate the publishable Convex component and typed host client from the packages/convex-invite workspace into your Convex backend. The repository includes an example app under apps/example that demonstrates a full secure integration with atomic membership creation.
convex-invite enforces single-use semantics through its invitation state machine. Once a token is redeemed, the component transitions the invitation to a consumed state so the same token cannot be used again. The README describes the component as managing secure, reusable invitation lifecycles, meaning the pattern is reusable across your application while each individual token is single-use.