Client API
Every client method, server-only endpoints, and rate limits.
Client methods
// Redemption, for the invite page
authClient.invite.get({ token });
authClient.invite.redeem({ token, ... });
// Management
authClient.invite.create({ kind?, type?, email?, name?, role?, maxUses?, expiresIn?,
organizationId?, organizationRole?, teamId?, presetSeatLimit? });
authClient.invite.list({ status?, type?, organizationId?, page?, limit? });
authClient.invite.revoke({ inviteId });
authClient.invite.delete({ inviteId });
// Mode-specific primitives, kept for compatibility
authClient.invite.accept({ token, password, name?, email? });
authClient.invite.activate({ token });
// Organization administration
authClient.invite.org.usage({ organizationId });
authClient.invite.org.setSeatLimit({ organizationId, seatLimit });
authClient.invite.org.disable({ organizationId, banMembers? });
authClient.invite.org.enable({ organizationId });
authClient.invite.org.delete({ organizationId, banMembers? });Server-only
For your own scheduler:
const { deleted } = await auth.api.cleanupExpiredInvites();Rate limits
Built-in limits: /invite/accept, /invite/activate, and /invite/redeem allow 5 requests per 60 seconds; /invite/get allows 10.
Better Auth stores rate-limit counters in memory by default. If you run more than one instance,
configure Better Auth's rateLimit.storage (for example "secondary-storage" with Redis) so the
limits are shared instead of per-pod. See Operations at scale.
Revoke, delete, and the email lock
In short: invite.revoke cancels an invite but keeps its protections active, invite.delete also removes the pre-created user and frees the address, and accepted invites are permanent audit records that cannot be deleted. The full semantics of the email lock, and why revoking is deliberately softer than deleting, are on the Security page.
Last updated on