---
title: "Create invite token"
method: POST
path: "/v1/invite/tokens"
tags: ["Invites"]
---

# Create invite token

`POST /v1/invite/tokens`

Generate a secure invite link to grant team members access to your profiles.
Invites expire after 7 days and are single-use.

Returns 403 when a requested profile is not found or not owned, or when
called with a restricted (zrk_) API key: invite management is admin-plane.

## Request body

- object
  - `scope` 'all' | 'profiles', required — 'all' grants access to all profiles, 'profiles' restricts to specific profiles
  - `profileIds` string[] — Required if scope is 'profiles'. Array of profile IDs to grant access to.
  - `role` 'admin' | 'member' | 'billing_admin' | 'viewer' — Org role granted to the invitee. Defaults to 'member'. 'admin' can manage the team (invite/remove members, change roles and access) and billing, but not ownership transfer or account deletion. 'billing_admin' (displayed as Billing Manager) manages billing only. 'viewer' creates a read-only member who can view everything in their profile scope but cannot perform any content mutation (publish, edit, delete, connect accounts).
  - `readOnly` boolean — Deprecated. Use role 'viewer' instead. When true, the invite is created with role 'viewer'. Cannot be combined with role 'billing_admin' or 'admin'.

## Response `201`

Invite token created

- object
  - `token` string
  - `scope` string
  - `invitedProfileIds` string[]
  - `expiresAt` string, date-time
  - `inviteUrl` string, uri

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — The API key is a restricted key (zrk_ prefix) and may not perform this operation. Three cases. (1) The operation's resource group (see the operation's x-resource-group) is disabled on the key: fix it by creating a key with the group enabled in the dashboard API keys tab and revoking the old one. (2) The operation is admin-plane (x-resource-group admin-plane: API keys, invites, connected apps, member identity), which is never grantable to restricted keys; the error reads "Restricted API keys cannot manage API keys, invites, or member identity." and the fix is a full-access key or the dashboard, never a new restricted key. (3) On webhook subscription writes, delivery-log reads and replays, a named event maps to a resource group the key does not hold, so a restricted key can never create or edit a subscription broader than itself (a no-messages key cannot subscribe to, test-fire, redeliver or read logs for message.* events).

---

[API](https://skmtc.net/zernio/apis/zernio-api.md) · [All operations](https://skmtc.net/zernio/apis/zernio-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zernio/zernio-api/versions/51932b099b2f/schema)