{"record":{"id":"4401645d64fe66d6","repo":"langgenius/dify","slug":"invitation-account-mismatch","errorCode":"invitation_account_mismatch","errorMessage":"This invitation was sent to another account. Please sign in with the invited account.","messagePattern":"This invitation was sent to another account\\. Please sign in with the invited account\\.","errorType":"error_code","errorClass":"InvitationAccountMismatchError","httpStatus":403,"severity":"error","filePath":"api/controllers/console/auth/activate.py","lineNumber":163,"sourceCode":"        \"\"\"Accept an invitation without letting an existing session act for another account.\n\n        Token-only activation remains available for legacy clients. When the request already\n        carries a console session, that session must belong to the account encoded in the\n        invitation before the token is consumed or tenant membership is changed.\n        \"\"\"\n\n        normalized_request_email = req_data.email.lower() if req_data.email else None\n        invitation = RegisterService.get_invitation_with_case_fallback(\n            req_data.workspace_id, req_data.email, req_data.token, session=db.session()\n        )\n        if invitation is None:\n            raise AlreadyActivateError()\n\n        account = invitation[\"account\"]\n        if extract_access_token(request):\n            current_account, _ = current_account_with_tenant()\n            if current_account.id != account.id:\n                raise InvitationAccountMismatchError()\n\n        if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(\n            account.email\n        ):\n            raise AccountInFreezeError()\n\n        tenant = invitation[\"tenant\"]\n        raw_role = invitation[\"data\"].get(\"role\")\n        try:\n            role = TenantAccountRole(raw_role) if raw_role else TenantAccountRole.NORMAL\n        except ValueError:\n            role = TenantAccountRole.NORMAL\n        if not TenantAccountRole.is_non_owner_role(role):\n            role = TenantAccountRole.NORMAL\n\n        membership_id = db.session.scalar(\n            select(TenantAccountJoin.id).where(\n                TenantAccountJoin.tenant_id == tenant.id,","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/activate.py#L145-L181","documentation":"Raised as InvitationAccountMismatchError (code 'invitation_account_mismatch') by POST /activate when the request carries a console access token whose session account.id differs from the account encoded in the invitation. The guard prevents an active session from consuming an invitation addressed to a different account.","triggerScenarios":"POST /console/api/activate while signed in as user A, but the invitation token was issued to user B (different email/account). The session account id != invitation account id.","commonSituations":"Shared workstation where a colleague left their session active; user logged in with one email but is trying to accept an invite sent to another; multiple accounts in the same browser.","solutions":["Sign out, then accept the invitation with the invited account's credentials (token-only flow).","Or sign in as the exact account the invitation was sent to before submitting the activation form.","Clear the console session cookie if unsure which account is active."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const session = await get('/account/profile');\nif (session.id !== invitedAccountId) {\n  // sign out before submitting, or sign in as the invited account\n}","typeGuard":null,"tryCatchPattern":"try {\n  await post('/activate', payload);\n} catch (e) {\n  if (e.code === 'invitation_account_mismatch') {\n    // sign out and retry as token-only, or sign in as the invited account\n  } else { throw e; }\n}","preventionTips":["Sign out before accepting an invitation on a shared machine.","Confirm the active session email matches the invited email before submitting."],"tags":["api","auth","invitation","session","authorization"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}