# Invite a teammate with a signed link

> Email a signed URL and store only a hash of the token. Do not email a temporary password.

- URL: https://laravel-vuejs.space/laravel-invite-teammate-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs

People searching “Laravel invite user Vue” create the user with a password and email the password. Send a signed link instead. The person sets a password when they arrive. Login itself stays the [Fortify guide](https://laravel-vuejs.space/laravel-fortify-vue).

> **TL;DR**
>
> -   Email a signed URL and store only a hash of the token.
> -   Do not email a temporary password.
> -   Do not put the raw token in the database.
> -   Do not put the invite URL behind an Inertia `<Link>` in the email.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3

## The fix

```php
$token = Str::random(32);

Invitation::create([
    'email' => $validated['email'],
    'token' => hash('sha256', $token),
    'invited_by' => $request->user()->id,
]);

$url = URL::temporarySignedRoute(
    'invites.accept',
    now()->addDays(3),
    ['token' => $token],
);
```

Mail `$url`. The accept route uses the `signed` middleware, hashes the token again, and finds the invitation. The Vue page on that route is a form for a name and a password. It is not a list of every user.

## What to avoid

> **Gotcha**
>
> Do not put the raw token in the database. Do not put the invite URL behind an Inertia `<Link>` in the email. The email is a normal `<a href>`. Do not skip `signed` because the token is long. The signature is what stops a edited query string.

## FAQ

**Q: How do I invite a teammate with a signed link?**

Email a signed URL and store only a hash of the token. Do not email a temporary password.

**Q: What goes wrong with Laravel invite user Vue?**

Many developers create the user with a password and email the password. Do not put the raw token in the database.