User Registration & Invitations

Complete guide to user registration using invitation tokens in SveltyCMS

7/7/2026

9 min read

On this page

Overview

SveltyCMS uses a secure invitation-based registration system where administrators create invitation tokens that allow new users to sign up with specific roles and permissions.

Note for Multi-Tenancy: In Multi-Tenant environments (like Demo Mode), the registration token is optional. Registering without a token will automatically create a new tenant and make you the administrator of that tenant.

All users (except the first user created during setup or new tenant owners) require an invitation token to register.

How Registration Works

For New Users

Receive Invitation: An administrator sends you an invitation email with a registration link containing a unique token
Click the Link: Opens the signup form with your email pre-filled and token automatically applied
Complete Registration: Enter username, password, and confirm password
Account Created: Your account is created with the role specified by the admin

For Administrators

Navigate to User Management: Go to /user page (requires admin permissions)
Access Admin Area: Admin area appears below profile settings for administrators
Create Invitation Token: Click “Email Token” or use the token management interface
Send Invitation: System generates the invitation link with embedded token
Monitor Usage: Track token usage and user registration status in the Admin Area

Registration Methods

Method 1: Direct Invitation Link

Best method for new users:

Administrator creates invitation token with your email
You receive an email with a link like: https://yoursite.com/login?invite_token=YOUR_TOKEN
Click the link to open the signup form
Email field is pre-filled and locked (based on invitation)
Token is automatically applied from the URL
Complete the remaining fields and submit

Method 2: Manual Token Entry

Alternative method if link doesn’t work:

Visit the login page at https://yoursite.com/login
Click “Sign Up” tab
Enter the invitation token provided by your administrator
Fill in all required fields
Submit the registration form

Method 3: OAuth Registration (if enabled)

Register using Google OAuth:

Enter your invitation token first (required)
Click the “OAuth” button to sign up with Google
Authenticate with your Google account
Account is created and linked to your Google identity
Role from the invitation token is automatically applied

Registration Form fields

Required fields

Username

3-50 characters
Unique across the system
Can contain letters, numbers, underscores, and hyphens

Email

Valid email address format
Pre-filled and locked when using invitation link
Used for account verification and communication

Password

Minimum length: 8 characters (configurable)
Password strength indicator shows:
- Red: 8-10 characters (weak)
- Yellow: 11-14 characters (medium)
- Green: 15+ characters (strong)
Real-time password strength validation

Confirm Password

Must exactly match the password field
Real-time validation

Registration Token

Unique 32-character invitation token provided by administrator (dash-less UUID)
Also supports 36-character format with dashes for compatibility
Auto-filled when using invitation link
Required for all new registrations

Invitation Token System

Token Properties

Each invitation token includes:

Email: The recipient’s email address
Role: User role (admin, editor, user, etc.)
Expiration: Token validity period
- 2 hours (2 hrs)
- 12 hours (12 hrs)
- 2 days (2 days) - recommended
- 1 week (1 week)
- 2 weeks (2 weeks)
- 1 month (1 month)
Tenant ID (multi-tenant mode): Specific tenant assignment
Status: Active, used, expired, or blocked

Token Lifecycle

Creation: Admin generates token with specific role and expiration
Active: Token can be used for registration
Used: Token consumed when user successfully registers
Expired: Token past its expiration date (can still be viewed)
Blocked: Token manually disabled by admin

Token Security {#token-lifecycle-security}

Tokens are unique, cryptographically secure strings
Each token can only be used once
Expired tokens cannot be reused
Tokens can be manually blocked by administrators
All token activity is logged for audit purposes

Admin User Management

Accessing the Admin Area

Location: /user page → Admin Area section (visible only to admins)

Three Main Sections:

Email Tokens: Create new invitation tokens
User Management: View and manage existing users
Token Management: View and manage invitation tokens

Creating Invitation Tokens

Step-by-Step Process:

Click the “Email Token” button in the Admin Area
Fill in the invitation form:
- Email: Recipient’s email address
- Username: Suggested username (user can change during signup)
- Role: Select from available roles
- Expires: Choose expiration period (recommended: 2 days or 1 week)
- Tenant ID (if multi-tenant): Assign to specific tenant
Click “Send Invitation”
System generates invitation email with embedded token link

Managing Users

User List Features:

View all registered users with detailed information
Sort and filter users by role, status, creation date
Search users by email or username
View user activity (sessions, last access)
Bulk operations (block/unblock multiple users)

User Information Displayed:

Blocked status indicator (✓/✗)
Avatar image
Email address
Username
Assigned role
User ID
Active sessions count
Last access date/time
Account creation date
Last updated date
Tenant ID (in multi-tenant mode)

Available Actions:

Edit User: Modify user profile and settings
Change Role: Assign different role to user
Block/Unblock: Disable or enable user account
Delete User: Permanently remove user account (use with caution)
View Sessions: See active user sessions
Reset Password: Force password reset for user

Managing Tokens

Token List Features:

View all invitation tokens (active, used, expired)
Filter tokens by status
Search by email or token
Monitor token usage patterns
Toggle “Show Expired Tokens” to include/exclude expired tokens

Token Information Displayed:

Blocked status
Associated email address
Assigned role
Token string (partially hidden for security)
Expiration date
Creation date
Last updated date
Tenant ID (in multi-tenant mode)

Available Actions:

Block Token: Prevent token from being used
Unblock Token: Re-enable blocked token (if not expired)
Delete Token: Remove token from system
Copy Token: Copy token string to clipboard
Resend Email: Send invitation email again

Password Requirements

Minimum Requirements

Length: At least 8 characters (configurable via PASSWORD_MIN_LENGTH setting)
Complexity: Mix of uppercase, lowercase, numbers, and special characters recommended

Password Strength Levels

Level 1 (Red - Weak):

8-10 characters
Minimum acceptable

Level 2 (Yellow - Medium):

11-14 characters
Better security

Level 3 (Green - Strong):

15+ characters
Recommended for admin accounts

Password Best Practices

Use a unique password not used elsewhere
Include uppercase and lowercase letters
Add numbers and special characters
Avoid common words or patterns
Use a password manager
Change password if compromised

Multi-Tenant Support

Tenant Assignment

In multi-tenant mode:

Users are assigned to specific tenants via invitation tokens
Tenant ID is displayed in user profiles
Users can only access data within their assigned tenant
Admin users may have cross-tenant access (depending on role)

Creating Tenant-Specific Invitations

Navigate to Admin Area → Email Tokens
Fill in user details
Select Tenant ID from dropdown (in multi-tenant mode)
User will be automatically assigned to the selected tenant upon registration

OAuth Integration

Google OAuth Registration

Requirements:

OAuth must be enabled in system settings (SHOW_OAUTH=true)
User must have a valid invitation token
Google OAuth must be properly configured

Process:

Enter invitation token in signup form
Click “OAuth” or “Sign up with Google” button
Authenticate with Google account
Grant required permissions
Account created and linked to Google identity
Role from invitation token is applied

Benefits:

No password to remember
Faster registration process
Secure authentication via Google
Single sign-on capability

Troubleshooting

Common Registration Issues

“Invalid or expired token”

Token may have been used already
Token may have expired
Token may have been blocked
Solution: Contact admin for a new invitation token

“Email already exists”

An account with this email already exists
Solution: Use the “Sign In” tab instead, or contact admin

“Username already taken”

Another user has this username
Solution: Choose a different username

“Password too weak”

Password doesn’t meet minimum requirements
Solution: Use a longer password with mixed characters

“Token required”

All new users need an invitation token
Solution: Request an invitation token from an administrator

OAuth button not working

OAuth may not be enabled
You may need to enter token first
Solution: Enter invitation token before using OAuth, or contact admin

Need Help?

For New Users:

Contact the administrator who sent your invitation
Check your spam folder for invitation emails
Verify the invitation link hasn’t expired

For Administrators:

Check system logs for detailed error messages
Verify email configuration is working
Ensure database is accessible
Review role and permission settings

Security Features

Rate Limiting

Registration attempts are rate-limited to prevent abuse:

200 requests per hour per IP address
100 requests per minute per IP + User-Agent
50 requests per minute per cookie

Token Security {#token-security-2}

Cryptographically secure random tokens
One-time use (consumed upon successful registration)
Configurable expiration periods
Manual blocking capability
Audit trail of all token activities

Account Security

Email verification (optional)
Strong password requirements
Two-factor authentication support (2FA)
Session management
Account blocking capability

API Endpoints

Registration Endpoint

POST /login?/signUp
Content-Type: application/x-www-form-urlencoded

username=johndoe&email=john@example.com&password=SecurePass123&confirmPassword=SecurePass123&token=invite_token_here

OAuth Registration

POST /login?/signInOAuth
Content-Type: application/x-www-form-urlencoded

token=invite_token_here