Registration Control

Declaring a strategy says how someone authenticates. It does not say whether a stranger may create an account in the first place. auth.allowSignUp is that second decision, and it is independent of which strategies you enabled.

auth:
  allowSignUp: false
  strategies:
    - type: emailAndPassword

The default is true because it is the right answer for a public product. It is the wrong answer for most internal tools and every customer portal — in those, an account is something you are given, and leaving self-registration on means anyone who finds the URL is one form away from a session.

Gating with Invitations

With self-registration off, you still need a way to onboard real people that does not involve an admin inventing and transmitting a password. Invitations are that path: an admin issues a single-use token, Sovrium emails a link, and the invitee sets their own password.

auth:
  allowSignUp: false
  strategies:
    - type: emailAndPassword
  invitationTokenExpiry: 7d

A duration string is <positive integer><unit> with unit one of s, m, h, d — 30s, 15m, 72h, 7d. A bare number is read as milliseconds. Anything else fails validation.

Shorter expiries suit high-security customer portals; the 72h default suits B2B onboarding, where an invitee may not check email the same day. Tokens are single-use either way, consumed on first successful accept.

Which Path to Use

Related Pages

• Invitations — the flow invitationTokenExpiry configures.
• User Management — admin bootstrap and the create-user API.
• Strategies Overview — the strategies array this sits beside.
• Email Templates — the invitation email body.
• Roles & RBAC — the role a newly created user receives.