Skip to main content
POST
Redeem a server invite and become a person on the server

Headers

Idempotency-Key
string
Required string length: 1 - 128

Body

application/json
invite
string
required

A server invite from POST /v1/invites.

Maximum string length: 200
handle
string
required

The handle to take: lowercase letters, digits and single dashes, at most 40 characters.

Maximum string length: 80
key_name
string
required

The name of the first access key, usually the machine that keeps it.

Maximum string length: 40
Pattern: ^[a-z0-9]+(-[a-z0-9]+)*$
display_name
string
Maximum string length: 80
client_token
string
write-only

Optional canonical base64url token containing exactly 256 random bits, generated and durably saved mode 0600 by the client before redemption. Bound locally to this issuer and invite. Send over HTTPS (loopback HTTP remains allowed locally); the server derives its HMAC verifier and never logs, caches or returns this token. No client digest acts as a bearer. Supplied token selects the additive 200 ClientConnected response.

Pattern: ^abh_[A-Za-z0-9_-]{43}$

Response

Client-generated key connected; metadata only, no token

200 response only when client_token was supplied. The key is metadata with no token. Legacy redemption without client_token retains its existing 201 Connected response, including its one-time server-generated token.

server_id
string
required
Pattern: ^srv_[0-9A-HJKMNP-TV-Z]{26}$
person
object
required
key
object
required

Access-key metadata that must not contain a token property.

onboarding
object
required

Nonsecret original redemption outcome bound to the authenticated client-generated key. Original handle is provenance, not a lookup/select-existing-account mechanism. Returned only after checking the key/person still work and current visibility of every board/request. A removed membership is never recreated by recovery; inaccessible entries are omitted.