Hi team, We're having an issue using the invitation workflow. Some of our clients use an email protection service that opens email links to scan them, invalidating the invite links. When the invite link is invalid, our clients land on the recovery page, attempting to add their email address and request a recovery link. However, as mentioned, some of our clients use email protection services, invalidating the recovery link. This results in a loop between the email and recovery page, frustrating our clients. For context, we implemented a similar approach from this doc: https://www.ory.sh/docs/kratos/manage-identities/invite-users. We're also using custom auth pages (not Account Experience). Has anyone encountered the same issue? Do you have any alternative approach for the invite workflow? Thanks!

For further context, even though we can mitigate the issue on recovery by using OTP, it results in a terrible user experience. 1. User receives an invite 2. Link immediately expires 3. User is redirected to recovery flow (unaware) and has to now do a password reset via OTP Overall just feels a bit clunky. This wasn't an issue we had with Auth0, I imagine because the links wouldn't expire on access, but rather when they were actually used (recovery actually happens).

Use OTP codes instead: https://www.ory.sh/docs/kratos/manage-identities/account-recovery#one-time-codes See also: https://www.ory.sh/docs/kratos/self-service/flows/account-recovery-password-reset#comparison

Hey @refined-kangaroo-48640, as described above, we did switch to OTP

When you first invite the user, are you generating an OTP recovery flow?

I'll defer to @mysterious-van-90907 to confirm

That guide instructs you to invite users by creating a recovery link for them. You may also invite them by creating a recovery code for them, through this API: https://www.ory.sh/docs/reference/api#tag/identity/operation/createRecoveryCodeForIdentity

you might be right. The issue isn't the expiry though.

Exactly, that's what I'm proposing.

so basically same flow, but the link won't expire

Hey @refined-kangaroo-48640, I see the response for the https://www.ory.sh/docs/reference/api#tag/identity/operation/createRecoveryCodeForIdentity is

{
  "recovery_link": "/ui/recovery?flow=1440ef91-3863-43e7-bb44-ecb64cc2eef3",
  "recovery_code": "118217",
  "expires_at": "2024-03-22T04:07:16.37783255Z"
}

Will the "recovery_link" not be invalidated if scanned by email scanners? Invalidating the flow ID?

Nope, because the user will have to input the code and submit the form.

Another thing, is there a way to send both OTP and recovery link UI using https://www.ory.sh/docs/reference/api#tag/frontend/operation/updateRecoveryFlow?

Not sure I'm following.

Would adding

{{ .RecoveryCode }}

and

{{ .RecoveryURL }}

in the email template work?

Should work, yes.

Thanks! We'll look into it.

Ah, I'm noticing right now the field

.RecoveryURL

is not available in the the OTP recovery template.

Hello everyone, thank you for raising this issue. You have also create a ticket in ZenDesk. Please use only one channel (ZenDesk) to discuss these issues, because otherwise we have multiple people working on the same topic which leads to confusion and duplicate work. Thank you!

Will do @high-optician-2097, thanks!