Hi everyone, we noticed that it's possible to skip the set password step in the invitation flow by closing the tab. Nonetheless a user gets a valid session which he can use to enter the website. Once this session is invalid one can only access the website again by triggering a recovery flow and setting a password (or doing the same thing again). I understand it from a security endpoint but the UX for the user feels kind of weak. Is there a way to force the user to set a password or at least let him know that no password is set until now? Maybe some property we can check?

Yes, you can use metadata for this. How I think it could work for you: • set metadata_public as “invitation_pending” or similar • when they change their password through settings flow, set the metadata as “invitation_accepted” • when a user wants to log in, use blocking webhook to check for this metadata. If it is pending, fail and display an appropriate message or redirect them to the UI to change the password. If it is accepted do nothing. Does that sound like it could work for you @silly-apartment-81257

Thanks for your help @magnificent-energy-493 🙏 That sounds like a reasonable approach. We will look into it ✌️

Let me know how it goes!