n8n-io/n8n · warning · BadRequestError

Invite links are not supported on this system, please use si

Error message

Invite links are not supported on this system, please use single sign on instead.

What it means

A BadRequestError (HTTP 400) from acceptInvitationWithToken when isSsoCurrentAuthenticationMethod() is true. Once the instance routes all authentication through SSO, invite-link-based signup is disabled because passwords are managed by the IdP. This is the token-acceptance counterpart of the invite-creation SSO block.

Source

Thrown at packages/cli/src/controllers/invitation.controller.ts:173

	/**
	 * Fill out user shell with first name, last name, and password using JWT token.
	 */
	@Post('/accept', {
		skipAuth: true,
		// Two layered rate limit to ensure multiple users can accept an invitation from
		// the same IP address but aggressive per inviteeId limit.
		ipRateLimit: { limit: 100, windowMs: 1 * Time.minutes.toMilliseconds },
	})
	async acceptInvitationWithToken(
		req: AuthlessRequest,
		res: Response,
		@Body payload: AcceptInvitationRequestDto,
	) {
		if (isSsoCurrentAuthenticationMethod()) {
			this.logger.debug(
				'Invite links are not supported on this system, please use single sign on instead.',
			);
			throw new BadRequestError(
				'Invite links are not supported on this system, please use single sign on instead.',
			);
		}

		if (!payload.token) {
			this.logger.debug('Request to accept invitation failed because token is missing');
			throw new BadRequestError('Token is required');
		}

		const { firstName, lastName, password } = payload;

		// Extract inviterId and inviteeId from JWT token
		const { inviterId, inviteeId } = await this.userService.getInvitationIdsFromPayload(
			payload.token,
		);

		return await this.processInvitationAcceptance(
			inviterId,

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Direct the user to sign in via the SSO/Identity Provider instead of the invite link.
2. If SSO was enabled in error, disable it and restart n8n, then the invite link will work again.
3. Re-issue invites only after confirming SSO is off, or provision users through the IdP.

// Check SSO state before showing the accept-invite UI.
const { ssoEnabled } = await api.get('/sso/config');
if (ssoEnabled) {
  redirect('/sso/login');
}

function isSsoActive(c: { ssoEnabled: boolean }): boolean {
  return c.ssoEnabled === true;
}

try {
  await api.post('/accept-invitation', payload);
} catch (e) {
  if (e.response?.status === 400 && /single sign on/i.test(e.response.data.message)) {
    redirect('/sso/login');
    return;
  }
  throw e;
}

When it happens

Trigger: POST to the accept-invitation endpoint with an AcceptInvitationRequestDto while SSO/SAML is the current authentication method. The check is the first guard in the handler, before token validation.

Common situations: SSO was enabled after invites were sent; users received invite emails before the cutover and click them post-cutover; bookmarked invite links used after migration to SAML.

Related errors

• SSO is enabled, so users are managed by the Identity Provide
• Invalid payload or URL
• This invite has been accepted already
• Token is required
• ${ssoIdentity.providerType.toUpperCase()} user may not chang

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/46902ee780a1af5a. Report an issue: GitHub.