# Optional global invite code
**URL:** https://meta.discourse.org/t/optional-global-invite-code/144376
**Category:** Announcements
**Tags:** new-feature, invites
**Created:** [March 15, 2020, 10:25am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376 "2020-03-15T10:25:52Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [March 16, 2020, 12:01am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/21 "2020-03-16T00:01:19Z")
First suggestion is invite tracking only? Yeah, sure. Username w/o token shouldn’t grant TL1 because usernames are public info.
> [@codinghorror](#):
>
> Second, you should be able to **generate invite links with no email** from the same place you send invites, per the above ☝… this completely resolves the “but I don’t know their email addresses 😿” problem.
May I suggest that these links take the form of `https://meta.discourse.org/signup?u=codinghorror&token=3ojk6WTY` to mirror the first part 🙂
> [@codinghorror](#):
>
> And if your site has approvals, then the secret password lets you skip approval too. If you don’t have approvals, you can’t get in without the secret password…
👍 didn’t think of that. Going to be tricky to document, but that’s how the settings should interact.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 16, 2020, 12:03am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/22 "2020-03-16T00:03:21Z")
Yeah there’s no downside to copying Discord here. I _think_ we had pure URL based invites (no email required) in the past but had to remove them due to security issues, do you remember @techapj? 🤔
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [March 16, 2020, 12:04am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/23 "2020-03-16T00:04:28Z")
Yeah, the “no email required” part was the security mistake there - these invites should still require email validation (or social login w/ email validation), because they’re not landing directly in people’s email inboxes.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 16, 2020, 12:15am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/24 "2020-03-16T00:15:54Z")
> [@sam](#):
>
> Please visit `amazing.forum.com/register?code=fantastic` to register and gain access to the forum
If the goal is to make this as easy to share, then what about approaching this like a referral code. Something that’s easily shared on a presentation deck, in plain text, or via word of mouth. Querystrings are confusing and fragile, whereas `domainname.tld/invite/samgdc2020` is memorable and low risk, the kind of thing people can scribble down and survive in transit.
As a precautionary measure I would really love to see some form of code expiration as a layer of protection too.
---
### Author:  [@justin](https://meta.discourse.org/u/justin)
#### Post date: [March 16, 2020, 12:48am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/25 "2020-03-16T00:48:08Z")
> [@Stephen](#):
>
> As a precautionary measure I would really love to see some form of code expiration as a layer of protection too.
Length of time and or number of uses would be a reasonable limit other software has implemented for this sort of thing. And it’s generally user defined.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [March 16, 2020, 12:55am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/26 "2020-03-16T00:55:53Z")
Indeed but looking at the PR it’s a single code for the entire site.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [March 16, 2020, 2:30am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/27 "2020-03-16T02:30:52Z")
> [@codinghorror](#):
>
> I _think_ we had pure URL based invites (no email required) in the past
Yes, we still have that feature around wrapped in a plugin:
> [@Generating lots of Invite Tokens](https://meta.discourse.org/t/generating-lots-of-invite-tokens/17563):
>
> warning This plugin is deprecated in favour of our core invite system. Summary: Generate multiple invite tokens link GitHub: [https://github.com/discourse/discourse-invite-tokens](https://github.com/discourse/discourse-invite-tokens)arrow_right Install: Follow the [plugin installation guide](https://meta.discourse.org/t/install-a-plugin/19157). Configuration Enable plugin After installing plugin enable site setting invite tokens enabled. Clone Discourse API Gem If you already have Git and Ruby installed on your system, you can install Discourse API by running following command from consol…
The URL will be of the form: `http://discourse.example.com/invite-token/redeem/TOKEN?username=USERNAME&email=EMAIL&name=NAME&topic=TOPICID`
Bare minimum URL should be: `http://discourse.example.com/invite-token/redeem/TOKEN?email=EMAIL`
> [@codinghorror](#):
>
> but had to remove them due to security issues
The security issue was that we did not check for the existence of user with the email address provided but now we do in the plugin.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [March 16, 2020, 9:40pm UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/28 "2020-03-16T21:40:22Z")
> [@riking](#):
>
> May I suggest that these links take the form of `https://meta.discourse.org/signup?u=codinghorror&token=3ojk6WTY`
I guess the username could be baked into the token be default and perhaps overwritten by adding an explicit user?
When it comes to `token`, I would prefer using `code` instead because it is comprehensible to non-technical people.
> [@codinghorror](#):
>
> > [@codinghorror](#):
> >
> > I _think_ we had pure URL based invites (no email required) in the past
>
> Yes, we still have that feature around wrapped in a plugin:
I believe not. While the tokens generated by the plugin don’t include emails, they can only be used by adding an email whereas here the idea is to remove that requirement, right?
> [@codinghorror](#):
>
> you should be able to **generate invite links with no email** from the same place you send invites, per the above ☝… this completely resolves the “but I don’t know their email addresses 😿” problem.
And the security issue can be resolved:
> [@riking](#):
>
> these invites should still require email validation (or social login w/ email validation),
This would be so awesome to have. 🙂
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 29, 2020, 3:34am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/29 "2020-03-29T03:34:19Z")
> [@sam](#):
>
> that at least they had an invite code that I shared privately.
Do these invite codes ever expire or are they good indefinitely forever? We might want a hard limit here as a site setting at least for now?
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [March 29, 2020, 7:33pm UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/30 "2020-03-29T19:33:34Z")
> [@techAPJ](#):
>
> Yes, we still have that feature around wrapped in a plugin:
Don’t we still need an email address for [GitHub - discourse/discourse-invite-tokens: Discourse Invite Tokens · GitHub](https://github.com/discourse/discourse-invite-tokens) to work? It could be I misunderstand how it works.
What I’d like would be a tailored link (without an email address) that I could get organisations to send out to their punters, which would then assign them to a group and a starting topic when they sign up. The reason for this is that the medical organisations I deal with cannot / will not share their email list, but are happy to send an email to their members (from them).
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 30, 2020, 1:48am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/31 "2020-03-30T01:48:20Z")
I think both your request here and @nathank’s feature request are pretty related.
At the moment we have 1 global invite code, it has no expiry, to expire it the admin can just zero out the code or change it.
What is being asked here is a more sophisticated mechanism for invite codes where it is integrated into the global invite system.
The key features that are being asked for
- New invite link
So this to me feels like an extension of this dialog:
Perhaps a tab there?
## `[bulk invite]`
- Strip email
- Strip send invite button
- Add
So once you fill that up you would get an invite link that works for a limited time, integrates with the rest of the invite system, allows you to add people to groups and so on.
With that in place we can actually remove the whole “invite code” global feature.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [March 30, 2020, 2:07am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/32 "2020-03-30T02:07:42Z")
Spot on - that would meet the need beautifully.
It would also be great to include a landing topic/post, as per the Bulk Invites via csv. Keeps it all consistent too.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 30, 2020, 2:09am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/33 "2020-03-30T02:09:11Z")
If it is relevant to current global events I support prioritizing this work but it is your call to make @sam
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [March 30, 2020, 2:46am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/34 "2020-03-30T02:46:06Z")
> [@nathank](#):
>
> Don’t we still need an email address for [GitHub - discourse/discourse-invite-tokens](https://github.com/discourse/discourse-invite-tokens) to work?
No, invite-tokens does not need email address. See [Generating lots of Invite Tokens](https://meta.discourse.org/t/generating-lots-of-invite-tokens/17563) to understand how it works.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [March 30, 2020, 3:35am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/35 "2020-03-30T03:35:32Z")
I’ve read that, but remain confused.
> [@Generating lots of Invite Tokens](https://meta.discourse.org/t/generating-lots-of-invite-tokens/17563/1):
>
> ## Prepare Invitation Links from Invite Token
>
> The Invitation URL will be like:
>
> ```plaintext
> http://discourse.example.com/invite-token/redeem/TOKEN?username=USERNAME&email=EMAIL&name=NAME&topic=TOPICID
>
> ```
>
> Replace following fields:
>
> -
> - `discourse.example.com` with the URL of your Discourse instance.
>
> -
> - `TOKEN` with one of the 200 Invite tokens you just generated.
>
> -
> - `EMAIL` with the email of user you want to invite
>
> - `USERNAME` with the desired username of invited user
> - `NAME` with the first name of invited user
> - `TOPIC` with the id of the topic to direct the user to after joining
>
> (\*) these fields are required!
This seems to imply very strongly that you need the user’s email. Or am I just being thick?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 30, 2020, 3:38am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/36 "2020-03-30T03:38:10Z")
My understanding of bulk invite tokens is that you get one token per invite. This is very far away from what you are desiring here.
I will discuss this with @techAPJ I feel onboarding people efficiently to a new forum is very relevant and important in the current time. We are going to prioritize improving this story.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [March 30, 2020, 5:11am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/37 "2020-03-30T05:11:11Z")
The email is required at the time of accepting invite but not at the time of invite token generation.
You can hand out this URL to end user and ask them to replace `EMAIL` with their email address: `http://discourse.example.com/invite-token/redeem/TOKEN?email=EMAIL`.
I hope this clears the confusion.
---
### Author:  [@pacharanero](https://meta.discourse.org/u/pacharanero)
#### Post date: [March 30, 2020, 8:28am UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/38 "2020-03-30T08:28:48Z")
Very much liking your proposed solution in [post 31](https://meta.discourse.org/t/optional-global-invite-code/144376/31) to this @sam, extending the functionality of invite codes.
---
### Author:  [@MitchB](https://meta.discourse.org/u/MitchB)
#### Post date: [April 1, 2020, 3:58pm UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/39 "2020-04-01T15:58:56Z")
Agreed that is also what I would really like to see implemented.
So that anyone that has access to the invite user permission is able to to generate a generic invite link that will let the user join and be added to the list of invited users of the referrer.
Invite to groups and with time/member limits would be nice but not a priority for me.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 2, 2020, 4:07pm UTC](https://meta.discourse.org/t/optional-global-invite-code/144376/40 "2020-04-02T16:07:40Z")
> [@sam](#):
>
> Please visit `amazing.forum.com/register?code=fantastic` to register and gain access to the forum
I’m getting a “Oops! That page doesn’t exist or is private.” when I try this.
`amazing.forum.com/signup` will pop up the signup modal, but `amazing.forum.com/signup?code=fantastic` doesn’t seem to pass the value into the modal (I also tried `invite_code=fantastic`).
And, when this works, it’d be nice to add it to the OP.
[Previous page](https://meta.discourse.org/t/optional-global-invite-code/144376.md?page=1)
[Next page](https://meta.discourse.org/t/optional-global-invite-code/144376.md?page=3)