Sign-up and invites
Who may make an account here is the realm’s sign-up mode. Invites bring in someone the mode would not let in by themselves. Both are in Manager › Sign-up and terms, on the Sign-up tab. You need operator rights for the platform.
The four modes
| Mode | Who may make an account |
|---|---|
| Open to everyone | Anyone with an e-mail address. |
| Only these domains | Anyone whose address is at one of the listed domains. A domain includes everything under it: example.se also lets in it.example.se. |
| By invitation only | Only someone with an invite, for the address it was sent to. |
| Closed | Nobody new, except through a platform invite. |
Sign-up always proves the address: Velrix sends a link, and the account is made when the person follows it. Changing the mode never touches accounts that already exist.
The setup wizard asks for the mode once; change it here at any time. It is also a policy (onboarding.signup) in Policies, so it can be exported with the rest.
Three kinds of invite
- An invite to the realm, from Invite people. It lets one address make an account, nothing more. Sending one needs the right to invite to the realm.
- An invite to an organisation, from the organisation’s page (Invite). The person joins that organisation with the role chosen. Whoever may manage the organisation’s members may send one, for a role no higher than their own.
- A platform invite, from Manager › People and roles (Invite person). The person gets a platform role, such as a second operator, a support agent or a billing administrator. Sending one needs the right to manage platform roles, and you can only hand out a role whose permissions you hold yourself.
Add person on People and roles gives a role to someone who already has an account. Enter an address nobody has, and it offers a platform invite with the same role instead.
What each invite can do, by mode
| Mode | Realm invite | Organisation invite | Platform invite |
|---|---|---|---|
| Open, Only these domains | Works (and lets in an address outside the domains) | Works | Works |
| By invitation only | Makes an account | Makes an account | Makes an account |
| Closed | No new account | Only for an address that already has an account | Makes an account |
On a closed realm, an organisation invite opened by someone without an account says New accounts are closed here. Ask an administrator of this instance, beside sign-in.
On a realm that is by invitation only, anyone who can make an organisation can invite people into it, and so bring new people onto the realm. If that is not what you want, close sign-up and use platform invites.
Every invite is for its own address
- An invite works once, and only for the address it was sent to. Someone signed in with another account is told This invite is for … Sign in with that account, or ask for a new invite. A forwarded or leaked link gives a stranger nothing.
- Signing up through an invite must use the invited address.
- An invite lives for a set time, then shows as Expired. Resend makes a new link with a new expiry, and the old link stops working. Revoke stops it at once.
- When the invite is taken, Velrix checks again that its sender still may hand out that role. An invite from someone who has since lost the right gives nothing.
- The links are stored only as hashes. Nobody, operators included, can read a live link back.
Sent invites are listed on the app they were sent from, with their state: Waiting, Joined, Expired or Revoked. Ended invites are kept for a while (the onboarding.invites retention policy, 30 days by default), then removed.
The mail
Invites go out as mail, so the realm needs a working mail channel (Realm mail). Their words are the templates onboarding.invite (realm), onboarding.inviteOrg and onboarding.invitePlatform, which you can change in Manager › Email templates. If the mail can’t be sent, the invite is not kept, and the sender is told.
Each person may send only so many invites in a while, so a stolen account can’t be used to mail out invites in bulk.