n8n-io/n8n · error · Error

Invitation accepted but no session cookie received

Error message

Invitation accepted but no session cookie received

What it means

acceptInvitation POSTs to /rest/invitations/accept and expects the response to set the new user's session cookie (it doubles as login on a fresh client). If no cookie arrives, the invitation may have been accepted server-side but the client cannot act as that user.

Source

Thrown at packages/@n8n/instance-ai/evaluations/clients/n8n-client.ts:721

				: undefined,
			error: error === '' ? undefined : error,
		}));
	}

	/**
	 * Accept an invitation. The response issues the new user's session cookie,
	 * so on a fresh N8nClient this doubles as their login.
	 * POST /rest/invitations/accept
	 */
	async acceptInvitation(opts: {
		token: string;
		firstName: string;
		lastName: string;
		password: string;
	}): Promise<void> {
		await this.fetch('/rest/invitations/accept', { method: 'POST', body: opts });
		if (!this.sessionCookie) {
			throw new Error('Invitation accepted but no session cookie received');
		}
	}

	/**
	 * Delete a user, including the data remaining in their personal project.
	 * DELETE /rest/users/:id
	 */
	async deleteUser(id: string): Promise<void> {
		await this.fetch(`/rest/users/${id}`, { method: 'DELETE' });
	}

	/**
	 * Pin a build thread's credential view to exactly these IDs (empty array =
	 * the thread sees no credentials).
	 * POST /rest/instance-ai/eval/thread-credential-allowlist
	 */
	async setThreadCredentialAllowlist(
		threadId: string,

View on GitHub (pinned to 5ac6606e81)

Solutions

Ensure the n8n instance and client share a cookie domain and the proxy forwards Set-Cookie.
After acceptInvitation fails, call login() explicitly with the new user's credentials to establish the session.
Verify the invitation token is unused and valid before accepting.

Defensive patterns

Strategy: fallback

Validate before calling

// Verify proxy forwards Set-Cookie before scripting:
const probe = await fetch(`${base}/rest/healthz`);
if (!probe.headers.get('set-cookie') && needsSession)
  console.warn('proxy may strip Set-Cookie; invitation flow can break');

Try / catch

try { await client.acceptInvitation(opts); }
catch (e) {
  if (e instanceof Error && e.message.includes('no session cookie')) { await client.login(opts.email, opts.password); }
  else throw e;
}

Prevention

Ensure cookie domain alignment between API origin and client.
After acceptInvitation, be ready to call login() explicitly.
Forward Set-Cookie through any proxy.

When it happens

Trigger: Proxy stripping Set-Cookie; cookie-domain mismatch when the API is on a different origin; the invitation endpoint accepting but not issuing a session (custom auth).

Common situations: Eval harness creating per-build users behind a reverse proxy; cross-origin setups; invitation tokens already consumed.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/51410d8e7020d8f7. Report an issue: GitHub.