Intake invitations

Invitations prove that a recipient email may access a lead or the lead inbox. Passwords remain WordPress-owned.

Typical flow

Notification / inbox-access email
  ↓
Secure invite URL (/vexal-intake/invite/{token})
  ↓
Account portal (login or register, email locked)
  ↓
Authorized lead destination

Account ownership

• Invite email is authoritative for registration
• Existing users sign in; new users create a subscriber account
• Owner association grants lead capability without opening wp-admin

Email validation

Invite paths lock the email field. Mismatched posted emails fail safely. Inbox owners can also be derived from Notifications To + BCC settings.

Authorized access

After authentication, Intake authorization decides which leads appear—not “any logged-in user.”