{"record":{"id":"51410d8e7020d8f7","repo":"n8n-io/n8n","slug":"invitation-accepted-but-no-session-cookie-received","errorCode":null,"errorMessage":"Invitation accepted but no session cookie received","messagePattern":"Invitation accepted but no session cookie received","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@n8n/instance-ai/evaluations/clients/n8n-client.ts","lineNumber":721,"sourceCode":"\t\t\t\t: undefined,\n\t\t\terror: error === '' ? undefined : error,\n\t\t}));\n\t}\n\n\t/**\n\t * Accept an invitation. The response issues the new user's session cookie,\n\t * so on a fresh N8nClient this doubles as their login.\n\t * POST /rest/invitations/accept\n\t */\n\tasync acceptInvitation(opts: {\n\t\ttoken: string;\n\t\tfirstName: string;\n\t\tlastName: string;\n\t\tpassword: string;\n\t}): Promise<void> {\n\t\tawait this.fetch('/rest/invitations/accept', { method: 'POST', body: opts });\n\t\tif (!this.sessionCookie) {\n\t\t\tthrow new Error('Invitation accepted but no session cookie received');\n\t\t}\n\t}\n\n\t/**\n\t * Delete a user, including the data remaining in their personal project.\n\t * DELETE /rest/users/:id\n\t */\n\tasync deleteUser(id: string): Promise<void> {\n\t\tawait this.fetch(`/rest/users/${id}`, { method: 'DELETE' });\n\t}\n\n\t/**\n\t * Pin a build thread's credential view to exactly these IDs (empty array =\n\t * the thread sees no credentials).\n\t * POST /rest/instance-ai/eval/thread-credential-allowlist\n\t */\n\tasync setThreadCredentialAllowlist(\n\t\tthreadId: string,","sourceCodeStart":703,"sourceCodeEnd":739,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/instance-ai/evaluations/clients/n8n-client.ts#L703-L739","documentation":"acceptInvitation POSTs to /rest/invitations/accept and expects the response to set the new user's session cookie (it doubles as login on a fresh client). If no cookie arrives, the invitation may have been accepted server-side but the client cannot act as that user.","triggerScenarios":"Proxy stripping Set-Cookie; cookie-domain mismatch when the API is on a different origin; the invitation endpoint accepting but not issuing a session (custom auth).","commonSituations":"Eval harness creating per-build users behind a reverse proxy; cross-origin setups; invitation tokens already consumed.","solutions":["Ensure the n8n instance and client share a cookie domain and the proxy forwards Set-Cookie.","After acceptInvitation fails, call login() explicitly with the new user's credentials to establish the session.","Verify the invitation token is unused and valid before accepting."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Verify proxy forwards Set-Cookie before scripting:\nconst probe = await fetch(`${base}/rest/healthz`);\nif (!probe.headers.get('set-cookie') && needsSession)\n  console.warn('proxy may strip Set-Cookie; invitation flow can break');","typeGuard":null,"tryCatchPattern":"try { await client.acceptInvitation(opts); }\ncatch (e) {\n  if (e instanceof Error && e.message.includes('no session cookie')) { await client.login(opts.email, opts.password); }\n  else throw e;\n}","preventionTips":["Ensure cookie domain alignment between API origin and client.","After acceptInvitation, be ready to call login() explicitly.","Forward Set-Cookie through any proxy."],"tags":["auth","n8n-api","invitations"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}