langgenius/dify · error · InvitationAccountMismatchError

invitation_account_mismatch

invitation_account_mismatch

Error message

This invitation was sent to another account. Please sign in with the invited account.

What it means

Raised as InvitationAccountMismatchError (code 'invitation_account_mismatch') by POST /activate when the request carries a console access token whose session account.id differs from the account encoded in the invitation. The guard prevents an active session from consuming an invitation addressed to a different account.

Source

Thrown at api/controllers/console/auth/activate.py:163

        """Accept an invitation without letting an existing session act for another account.

        Token-only activation remains available for legacy clients. When the request already
        carries a console session, that session must belong to the account encoded in the
        invitation before the token is consumed or tenant membership is changed.
        """

        normalized_request_email = req_data.email.lower() if req_data.email else None
        invitation = RegisterService.get_invitation_with_case_fallback(
            req_data.workspace_id, req_data.email, req_data.token, session=db.session()
        )
        if invitation is None:
            raise AlreadyActivateError()

        account = invitation["account"]
        if extract_access_token(request):
            current_account, _ = current_account_with_tenant()
            if current_account.id != account.id:
                raise InvitationAccountMismatchError()

        if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(
            account.email
        ):
            raise AccountInFreezeError()

        tenant = invitation["tenant"]
        raw_role = invitation["data"].get("role")
        try:
            role = TenantAccountRole(raw_role) if raw_role else TenantAccountRole.NORMAL
        except ValueError:
            role = TenantAccountRole.NORMAL
        if not TenantAccountRole.is_non_owner_role(role):
            role = TenantAccountRole.NORMAL

        membership_id = db.session.scalar(
            select(TenantAccountJoin.id).where(
                TenantAccountJoin.tenant_id == tenant.id,

View on GitHub (pinned to ef8544b173)

Solutions

Sign out, then accept the invitation with the invited account's credentials (token-only flow).
Or sign in as the exact account the invitation was sent to before submitting the activation form.
Clear the console session cookie if unsure which account is active.

Defensive patterns

Strategy: validation

Validate before calling

const session = await get('/account/profile');
if (session.id !== invitedAccountId) {
  // sign out before submitting, or sign in as the invited account
}

Try / catch

try {
  await post('/activate', payload);
} catch (e) {
  if (e.code === 'invitation_account_mismatch') {
    // sign out and retry as token-only, or sign in as the invited account
  } else { throw e; }
}

Prevention

Sign out before accepting an invitation on a shared machine.
Confirm the active session email matches the invited email before submitting.

When it happens

Trigger: POST /console/api/activate while signed in as user A, but the invitation token was issued to user B (different email/account). The session account id != invitation account id.

Common situations: Shared workstation where a colleague left their session active; user logged in with one email but is trying to accept an invite sent to another; multiple accounts in the same browser.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/4401645d64fe66d6. Report an issue: GitHub.