Skip to content
Manybases
esc

Search pages and sections. Try a tool name, an error code, a route.

↑↓ navigate↵ openesc close
  1. Guides
  2. Guides
  3. Invite users
Docs

Guides · Guides

Invite users

How the first people get into an app, what a seat is, and the two gestures only a human makes.

The four steps#

  1. Set the app's URL. Invitation links are built from it — the sign-up page belongs to your app, not to Manybases. A human sets it in the project's Settings (a two-step confirmation, because changing it redirects every user), or the first site deployment fills it in.
  2. Put a publishable key in the front end. Every publishable key signs users up, whoever created it: your agent with create_key, or you from the API keys screen or the Deploy → Third-party tab. (Until 2026-09-07 a key created by an agent was inert and could not; that rule is removed.)
  3. People sign up on your app: POST /v1/auth/signup with { email, password } and the publishable key. No invitation is needed — sign-up is open (below). Each sign-up takes a seat.
  4. A signed-in person invites someone, from your app: POST /v1/invites with the publishable key and their session returns https://<your app URL>/i/<token>, single-use, valid 7 days. Share it yourself — no e-mail is sent. The invited person signs up on your app's page for /i/<token>, which must pass the token along: POST /v1/auth/signup with { email, password, invite: "<token>" }. The API consumes the link at that moment; two people racing on the same link cannot both succeed.

Neither you nor your agent mints invitation links: the invite_user tool and its account-key route were removed on 2026-09-22, and the dashboard's Users screen stopped minting links on 2026-09-20. A link already issued stays valid until it expires.

The SDK's signup does not carry the invite field yet: for an invited sign-up, call the route directly with the three fields, then hand the returned session to the SDK with setSession.

Seats#

3 per app on Free, 1 000 on Builder and Studio. A seat is taken at sign-up: seats.used counts the people signed up to the app, and the response of a sign-up counts the person who just signed up. An invitation reserves no seat — inviting ten people on a three-seat app is allowed. At the cap, a sign-up answers 402 quota_exceeded and creates nothing; the invitation link it carried stays usable. Signing in is never refused by the cap. Deleting a user frees their seat. Anonymous visitors of a public table take no seat, and joining a space takes no extra one.

Sign-up stays open#

An invitation attributes and shares; it closes nothing. Anyone who holds the publishable key — public by design — can sign up without a link. If an app must be closed to strangers, keep its address to yourself and its tables on presets that show nothing to a newcomer (prive, espaces); the seat cap bounds the damage. A stranger's sign-ups do take seats: delete them from the Users screen to free them.

Resetting a password#

From the Users screen or the reset_password tool, a human obtains a single-use link valid one hour and hands it to the person. Nothing changes until it is used; using it signs the person out everywhere. See Users.