SSOGEN / Learn / Self-Registration vs Invitation: How External Users Get an Account
Learn
Self-Registration vs Invitation: How External Users Get an Account
Self-registration means a person creates their own account on a public sign-up page; an invitation means an administrator creates the account and the person only sets a password. Invite people you already know; open self-registration for people you do not know yet.
Updated
Self-registration (self sign-up) lets an outside person create their own account. An invitation starts on the other side: an administrator creates the account and emails a link. The rule of thumb is simple. Invite people you already know, such as a named supplier contact. Open self-registration when you cannot list the people in advance, such as buyers on an ordering portal.
The two routes differ in who vouches for the person and when. With an invitation, an administrator vouches before the email is sent. With self-registration, the mailbox proof comes first and the vouching, if any, comes after.
The two routes, step by step
Invitation
- An administrator creates the account with the person’s name and email address.
- The system emails a one-use link. The account exists, but has no password.
- The person opens the link and sets a first password.
- The link stops working once used, or when it expires.
Self-registration
- The person opens the sign-up page and enters an email address.
- The system sends a code or a link to prove the mailbox.
- The person enters the code, then chooses a name and a password.
- If approval is required, the request waits for an administrator.
- The account is created after approval, or at once where none is required.
The order matters. In a careful self-registration design, no account exists until the mailbox is proved and the request approved. Spam requests then never become accounts.
Which route fits which external user
| External user | Route | Approval | Reason |
|---|---|---|---|
| A named contact at a contracted supplier | Invitation | Not needed; the inviter vouched | You know the person before they arrive |
| Colleagues of that contact | Self-registration on the supplier’s entry | Yes | You know the company, not each person |
| New buyers on an ordering site | Self-registration | Yes, or none for low-risk content | You cannot list them in advance |
| An outside auditor for one engagement | Invitation | Not needed | Access is narrow and time-bound |
| A list of 300 dealer staff | Invitation by file import | Not needed | The dealer supplied the list |
| A business customer with its own identity provider | Federation | Per contract | Its users never need a password with you |
Federation, where the customer’s own provider signs its users in, is covered in federated identity vs SSO.
Five decisions before you open sign-up
1. Does a person approve each request?
Approval turns sign-up into a queue. It suits supplier and partner portals, where one fake account can see prices or orders. Name who approves, and expect them to reject spam with a reason the requester can read.
2. How does the person prove the mailbox?
Send a short numeric code or a link. A code suits a person who signs up on a laptop and reads mail on a phone. A link suits a single device.
Keep both short-lived. NIST SP 800-63A-4, section 3.8, caps a confirmation code sent to a validated email address at 24 hours and requires it to be invalidated once used.
3. How long does an invitation link last?
An invitation can live longer than a mailbox code, because an administrator already vouched for the person. A week is a common default. Shorten it for privileged portals; allow a resend rather than a very long lifetime.
4. What may a self-registered person reach?
Applications only, never administrative power. A sign-up should place the person in one group that grants one portal. Before opening sign-up, list every application that group reaches, including through catch-all groups.
5. What happens to requests nobody decides?
Unanswered requests accumulate and go stale. Remove them after a fixed window, such as two weeks, so a forgotten request cannot be approved months later by mistake. Cancel unaccepted invitations the same way.
Worked example: a supplier portal with both routes
Acme Corp runs a supplier portal at suppliers.acme.example.
- The first contact is invited. Purchasing invites John Doe at
globex.example. He sets a password from the link the same afternoon. - His colleagues sign up. Jane Smith, also at Globex, uses the portal’s sign-up page. She enters the emailed code, chooses a password, and her request waits.
- A person approves. An Acme purchasing administrator checks that Globex is a current supplier and approves Jane. Her account now exists, in the supplier group only.
- Spam expires. A request from
mail.examplethat nobody recognizes is rejected; one nobody looked at is removed after the window.
Enrollment vs registration: the terms
Registration creates the account. Enrollment, in NIST’s usage, is the step in which an identity-proofed applicant becomes a subscriber of the service; the term also covers adding an authenticator, such as an authenticator app, to an existing account. A self-registered person typically registers with a mailbox and a password, then enrolls a second factor.
Questions people ask
What does “self-registration” mean?
Self-registration means a person creates their own account without an administrator setting it up. On a sign-up page they enter an email address, prove they control it, and choose a password. Many systems add an approval step before the account exists. It suits customer and partner portals where you cannot list every user in advance.
What is enrollment vs registration?
Registration creates an account: an identifier, a verified contact address and a password. Enrollment usually means binding something more to an identity, such as identity proofing or an authenticator like a passkey or an app. In NIST SP 800-63A-4, enrollment is when a proofed applicant becomes a subscriber. In practice, people register once and enroll factors afterward.
How do you enroll step by step in a self-registration portal?
The usual sequence has four steps. Open the portal’s sign-up page and enter your work email. Enter the code or open the link the portal sends. Choose your name and password. Wait for approval if the portal requires it, then sign in and set up a second factor if asked.
Should invited users also need approval?
Usually not. The administrator who sent the invitation already decided the person should have access. Adding approval to an invitation duplicates that decision and delays the person. Keep approval for self-registration, where the first decision about the person happens after they arrive.
How SSOGEN handles invitations and self sign-up
In SSOGEN, an administrator creates the person with Send an invitation email; the account exists at once, and a one-use link, valid 7 days by default (1 to 30), sets the first password. Create an account is off by default. The person proves the mailbox with an 8-digit code (15 minutes) or a link (24 hours by default). Approval is on by default, and undecided requests are removed after 14 days. See customer identity with SSOGEN.
Where to go next
- The bigger picture. CIAM vs IAM explains how customer identity differs from workforce identity.
- Protecting the sign-up page. CAPTCHA alternatives covers limits, puzzles and disposable addresses.
- More explainers. The Learn hub lists related pages.
Sources, all read 2026-11-15: NIST SP 800-63A-4, Identity Proofing and Enrollment, sections 1.1, 2.1 and 3.8.