Most invite-link implementations look correct in development and break in production. The edge cases aren't exotic — they're the normal concurrency you get when two people click the same link, or when someone clicks an expired token, or when a seat limit is hit between the check and the insert.
Here's how I built an invite flow that handles all of them, using SvelteKit, Postgres, and Drizzle ORM.
The flow looks simple
Owner creates invite → single-use link sent → recipient clicks → membership created → done
Enter fullscreen mode
