Let people in with a code. Take it back with one call.

InviteGuard creates and tracks invite codes for your apps. Your app verifies a code at sign-up and checks access at login. You can revoke anyone, at any time, from the dashboard or the API.

Join the waitlist See the API

Lumen private beta

LUMEN-7XK2-M9QP

1 use
Expires 30 Nov
Grants 14 days

Redeemed by

ada@example.com

Try it: this is what your app sees at Ada’s next login.

POST /api/v1/check-access

{
  "success": true,
  "data": {
    "allowed": true,
    "appId": "app_lumen",
    "grant": { "status": "active", "remainingDays": 14 }
  }
}

Three calls cover the whole life of an invite

POST /api/v1/verify
Verify at sign-up
Your app sends the code. InviteGuard checks every rule on it, records who redeemed it and uses it up.
POST /api/v1/check-access
Check access at login
A read-only call that answers one question: is this person still allowed in? It also says how long a trial has left.
POST /api/v1/revoke
Revoke when you need to
Cut off a code, an email or a user ID from the dashboard or the API. The next access check says no. Restore it just as fast.

Rules you can stack on one code

Each rule is a setting on the code, and they combine. A single code can be locked to one email, work once, expire in a week and grant 14 days of access when it’s redeemed.

One use: Burned on the first redemption. The classic personal invite.
N uses: One code for a whole group, up to the number you set.
Unlimited: Valid until you revoke it. Good for a public beta link.
Email-locked: Only works for one address, and never reveals which.
Expiring: Stops working after a date, whether it was used or not.
Timed grant: Redeeming it starts a trial: 7 days, 14 days, whatever you choose.

One request at sign-up

Plain JSON over HTTPS with an API key. Codes and keys are stored hashed, and a key is shown only once. A failed check comes back as a clear reason, such as CODE_EXHAUSTED or EMAIL_MISMATCH, that your app can show to the user.

Request

curl "$INVITEGUARD_URL/api/v1/verify" \
  -H "Authorization: Bearer $INVITEGUARD_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "LUMEN-7XK2-M9QP",
    "email": "ada@example.com"
  }'

Response

{
  "success": true,
  "data": {
    "valid": true,
    "codeId": "code_abc123",
    "appId": "app_lumen",
    "remainingUses": 0,
    "grant": {
      "expiresAt": "2026-11-14T10:00:00.000Z",
      "durationSeconds": 1209600
    }
  }
}

Who it’s for

Private betas

Hand testers a personal code, see who actually signed up, and close the door when the beta ends.

Several apps, one place

Every app gets its own codes and keys. One dashboard shows how all of them are doing.

Trials without billing code

A timed grant gives someone 14 days. Your app asks check-access and decides what happens after.

Events and communities

One code with 100 uses and an end date for a meetup, a newsletter or a launch.

Hosted InviteGuard is on the way

We use InviteGuard to gate betas of our own apps today. A hosted version you can sign up for is next. Leave your email and we’ll tell you when it opens. Tell us what you’d gate and it helps us decide what to build first.