Test hosted sign-in and recovery

Use this checklist to test hosted sign-in, sign-up, password reset, logout, and invitation acceptance for the intended site.

1. Open Sign In with a non-production account. A valid account reaches the configured destination; an invalid credential remains on the hosted flow so the user can correct it.
2. Test Sign Up only when security.signup-enabled is enabled. A successful registration follows the hosted outcome; when disabled, use an invitation instead of retrying sign-up.
3. Select Forgot Password, submit the eligible account, then complete the reset and use Back to Sign In or Continue to Sign In. For an expired or invalid reset path, restart from Forgot Password.
4. Select Logout and verify the session ends before testing another account.

Two-factor authentication and email verification aren't available yet; the Enable 2FA security setting currently has no effect. For a hosted automatic redirect, use OpenID Connect SSO.

Accept an invitation

Invitation links expire 7 days after they are sent. Opening a link also verifies that its token exists and that the invitation has not already been used.

1. Select Accept Invitation from a valid invitation link and verify the organization and invited identifier shown by the hosted page.
2. Review the prefilled name. Existing account details can be locked; a new invitee completes first name, last name, password, and password confirmation.
3. Submit the invitation. After acceptance, the Console attempts sign-in. When the response includes an organization slug, it opens that organization; otherwise it returns to the organizations list.
4. If automatic sign-in fails, use Try Login Again. If that retry cannot be completed, select Go to Login Page.

Recover an invitation link

Link state	Current outcome	Recovery
Missing or invalid token	The hosted page shows an invalid-link error and cannot load invitation details.	Select Go to Login, then ask the organization administrator to verify the Pending invitation. If the token is invalid, delete that invitation and send a new invitation.
Expired	The link is rejected after the configured expiry period.	Ask the administrator to delete the expired invitation and send a new invitation; resending the same expired record does not create a new expiry window.
Already used or accepted	The link is rejected because invitation acceptance is complete.	Select Go to Login and ask the administrator to verify the Accepted member, group, and site access. Do not send a duplicate invitation.
Pending but the email was not received	The invitation remains usable until it expires.	Ask the administrator to use Resend invitation from Invitations, then retry the newest delivered link.

There is no supported decline action in the hosted page or invitation endpoint. An invitee who does not want to accept should ask the organization administrator to Delete the pending invitation.

For unresolved hosted-flow failures, see troubleshooting.