Comment by Tom Fagerland on "Expiration Token Link: How can I Invite new users via invitation links that can be used for creating an account only once?"

Basically:

1: Make a controller targetting /invite/{uuid}

2: When creating an invite link, generate a UUID with the necessary info and place it in cold storage (redis, couchdb, postgres, whatever)

3: When /invite/{that-exact-uuid} gets hit, get the info and create the account.

4: Delete that-exact-uuid from cold storage, or mark it as "used" and return a quick message to that effect when hit again.

Note that you probably won't need to make a controller targetting the actual UUID, just the /invite/ part. Then you grab the UUID by parsing the request path. API: expressjs.com/en/4x/api.html

This is called a "path variable", by the way. It would be easier to do with "request parameters", but it would be like one code line fewer in practice, and this looks better ;)

Search Hashnode