Onboard Users by Sending Email Invitations
For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Add users to a tenant or instance by invitation.

Administrators can invite users with pre-configured RBAC permissions. If an email server is configured, Kestra sends the invitation link by email. Otherwise, you can copy and share the link manually.

How to invite users

  1. Go to IAM in the sidebar and open the Users tab.
  2. Click + Add.
  3. Enter the user’s email address and select a group (via the Groups tab) or assign a role directly (via the Roles tab).
  4. Click + Add to send the invitation email or display the shareable link.

Accepting invitations

When a user receives an invitation, they can click the link in the email to accept it. The user is redirected to the Kestra login page, where they create a password or log in with SSO if enabled.

If password-based login is enabled, the password they choose must satisfy the instance password policy configured under kestra.security.basic-auth. See Security and Secrets configuration for the available password policy settings.

Invite expiration time

Users have 7 days to accept the invitation. After this period, the invitation expires and must be reissued.

To change the default expiration, set expireAfter in kestra.security.invitations. For example, to set 30 days:

kestra:
  security:
    invitations:
      expireAfter: P30D

Was this page helpful?