Skip to main content
Hand-maintained reference. For the authoritative flags on your installed version, run the command with --help.
Spec recipient types per §7.7: email, phone, oidc, did. All four are wired in the CLI. 
# email — bare positional, or explicit --type
afauth invite alice@example.com --service https://api.example.com
afauth invite --type email --value alice@example.com \
              --service https://api.example.com

# phone — E.164
afauth invite --type phone --value +14155550173 \
              --service https://api.example.com

# oidc — issuer + subject (no --value)
afauth invite --type oidc \
              --issuer https://accounts.google.com --sub 12345 \
              --service https://api.example.com

# did
afauth invite --type did --value did:web:alice.example \
              --service https://api.example.com

# optional: post-claim redirect (host must be in the service's allow-list per §7.2)
afauth invite alice@example.com --service https://api.example.com \
              --redirect-url https://yourapp.com/welcome