Implement an Invite-Only Flow with Auth0 Organizations on a Database Connection

Last Updated: Nov 6, 2026

Overview

Administrators restrict Auth0 organization membership to invited users by disabling sign-ups on the database connection, disabling the Organization Signup and Membership authentication setting, and provisioning users via the Management API. This configuration prevents uninvited users from signing up or logging in when they know the organization login URL. This solution applies exclusively to Auth0 database connections and excludes passwordless, social, and enterprise connections.

Applies To

Auth0
Organizations
Database Connections

Solution

How does an administrator implement an invite-only flow?

A new invitee cannot self-register through a native organization invitation while sign-ups are disabled on the database connection. Instead, administrators disable sign-ups on the connection, provision invited users with the Management API, and send each user a password-change link as the invitation. Administrators must not enable Organization Signup for this use case. Enabling this feature overrides the connection sign-up restriction and allows anyone who reaches the organization login prompt to register and join.

Implement the invite-only flow by disabling sign-ups, provisioning the user, and generating a password-change ticket.

Disable sign-ups on the database connection by selecting Disable Sign Ups.
Enable the connection for the organization. Leave Organization Signup and Membership on Authentication disabled.
NOTE: With Membership on Authentication enabled, existing users of the connection who log in through the organization become members automatically, and removed members return to the organization.
Create the user using POST /api/v2/users on that connection.
Add the user to the organization using POST /api/v2/organizations/<id>/members. Assign organization roles if needed.
Generate a password-change ticket using POST /api/v2/tickets/password-change and send the returned link to the user. The link acts as the invitation. Include the following parameters in the request:
- user_id: The user created in step 3.
- client_id: The application the user accesses after setting a password.
- organization_id: Applies organization branding to the page and adds organization_id and organization_name to the redirect.
- ttl_sec: The duration the link remains valid. The default is 432000 seconds (5 days).
- mark_email_as_verified (optional): Set to true to mark the user email as verified when the ticket is used.
NOTE: Do not send result_url with organization_id. These parameters conflict, and result_url fails with Universal Login.

The password-change ticket acts as the invitation.

Creating the user through the API means the user does not know the password. The ticket allows the user to set a password, and the link doubles as the invitation.

What happens after the user sets a password?

With New Universal Login, when client_id is provided in the ticket request, Auth0 prompts the user to go to the application default login route. Administrators must configure the route as the Application Login URI or the Tenant Login URL. The redirect carries the organization ID when organization_id is provided. The application then starts a new login using that organization ID.

How does the administrator customize the invitation link text?

The POST /api/v2/tickets/password-change endpoint returns a unique password reset ticket link for a specific user, but Auth0 does not send the link to the user. The administrator must copy the link into an email formatted as an invitation, explaining that the user must use the link to set the account password.

The link directs the user to the default hosted password reset page, which contains the standard password-reset wording. Administrators can change this wording using the Universal Login custom text feature.

NOTE: This customization applies to the password reset prompt for the entire tenant. The wording must cover both invitation and standard password reset flows to avoid user confusion.

What occurs if the link expires?

The link stops working after ttl_sec passes (5 days by default). Administrators generate a new ticket for the same user and send the new link. Administrators do not need to recreate the user.

This configuration blocks uninvited users.

Disabling sign-ups and omitting the Organization Signup override hides the sign-up link and rejects sign-up requests to the connection. Auth0 does not create an account through the login page for an uninvited person. Only users that an administrator adds as organization members can authenticate into the organization.

How does an administrator revoke access?

Administrators remove the user from the organization using DELETE /api/v2/organizations/<id>/members or from the Auth0 Dashboard. With Membership on Authentication disabled, Auth0 does not re-add the user upon login. To remove the user from the tenant completely, administrators delete or block the user account.

The flow avoids native organization invitations.

Native invitations (POST /api/v2/organizations/<id>/invitations) let the invitee create an account and join. The sign-up step conflicts with a disabled sign-up setting. Making this work for new invitees requires enabling Organization Signup, which makes sign-up public. Administrators use native invitations only if self-registration into the organization is acceptable.