# Accept invite and set password

> Source: https://docs.clonepartner.com/api-reference/auth/accept-invite/

`POST /api/auth/accept-invite`

Accepts an invite token and sets the user's password. When TOTP is
required, generates a TOTP secret for enrollment. When TOTP is disabled
(`auth.totp_required: false`), issues a full session immediately. The
token is marked as used after this call; when TOTP is required, invite
validation can still return `totp_pending: true` until verification completes.

**Operation ID:** `acceptInvite`

## Authentication

No authentication is required.

## Request body

The request body is required.

### `application/json`

- Type: `object`
- Properties:
  - `token` (`string`, `required`)
  - `password` (`string`, `required`)

## Success responses

### 200

Password set. When TOTP is required, returns TOTP enrollment data.
When TOTP is disabled, returns `{ authenticated: true }` with a full
session cookie.

**Content type:** `application/json`

- Type: `object`
- Properties:
  - `totp_secret` (`string`)
  - `totp_uri` (`string`)
  - `authenticated` (`boolean`)

## Error responses

### 400

Invalid/expired token or validation error


## Examples

### cURL

```bash
curl --request POST \
  --url 'https://your-envoy.example.com/api/auth/accept-invite' \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string",
  "password": "string"
}'
```

### JavaScript (fetch)

```javascript
const response = await fetch('https://your-envoy.example.com/api/auth/accept-invite', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "token": "string",
    "password": "string"
  }),
});

if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = response.status === 204 ? null : await response.json();
console.log(data);
```