This PR introduces a flow for creating organizations via a temporary bootstrap admin account:
Temp Account Creation
A short-lived “admin” account is spun up solely to bootstrap a new organization.
Authenticate Temp Account
The temp account authenticates via Client API to obtain an access_token.
Organization Creation
Using the token, the temp account creates the organization (/api/organizations).
A raw 32-byte organization key (org key) is generated at this step.
Invite Real Owner
Temp account sends an invite (/api/organizations/:id/invite) to the intended real owner’s email.
Real Owner Registers
Owner accepts the invite, sets a master password, and generates their RSA keypair (public/private).
Automated Confirmation + akey Injection
If invited_by_email matches the temp account, the invite is auto-confirmed.
The raw org key is encrypted with the owner’s public key.
The encrypted blob is stored as their akey.
Temp Account Leaves
Once ownership is handed over, the temp account is removed from the org (DELETE /api/organizations/:id).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6336
**Author:** [@cs4dev](https://github.com/cs4dev)
**Created:** 10/1/2025
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `feature/automated-onboarding-confirmation`
---
### 📝 Commits (1)
- [`0aa7f3a`](https://github.com/dani-garcia/vaultwarden/commit/0aa7f3aedf7c49c68b116a7c57fdd1bcc2acef6a) feature: automated onboarding + confirmation
### 📊 Changes
**6 files changed** (+147 additions, -5 deletions)
<details>
<summary>View changed files</summary>
📝 `Cargo.lock` (+10 -0)
📝 `Cargo.toml` (+4 -0)
📝 `macros/Cargo.toml` (+6 -0)
📝 `src/api/core/organizations.rs` (+83 -4)
📝 `src/config.rs` (+3 -1)
📝 `src/crypto.rs` (+41 -0)
</details>
### 📄 Description
## This PR introduces a flow for creating organizations via a temporary bootstrap admin account:
### Temp Account Creation
A short-lived “admin” account is spun up solely to bootstrap a new organization.
### Authenticate Temp Account
The temp account authenticates via Client API to obtain an access_token.
### Organization Creation
Using the token, the temp account creates the organization (/api/organizations).
A raw 32-byte organization key (org key) is generated at this step.
### Invite Real Owner
Temp account sends an invite (/api/organizations/:id/invite) to the intended real owner’s email.
### Real Owner Registers
Owner accepts the invite, sets a master password, and generates their RSA keypair (public/private).
### Automated Confirmation + akey Injection
If invited_by_email matches the temp account, the invite is auto-confirmed.
The raw org key is encrypted with the owner’s public key.
The encrypted blob is stored as their akey.
### Temp Account Leaves
Once ownership is handed over, the temp account is removed from the org (DELETE /api/organizations/:id).
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6336
Author: @cs4dev
Created: 10/1/2025
Status: ❌ Closed
Base:
main← Head:feature/automated-onboarding-confirmation📝 Commits (1)
0aa7f3afeature: automated onboarding + confirmation📊 Changes
6 files changed (+147 additions, -5 deletions)
View changed files
📝
Cargo.lock(+10 -0)📝
Cargo.toml(+4 -0)📝
macros/Cargo.toml(+6 -0)📝
src/api/core/organizations.rs(+83 -4)📝
src/config.rs(+3 -1)📝
src/crypto.rs(+41 -0)📄 Description
This PR introduces a flow for creating organizations via a temporary bootstrap admin account:
Temp Account Creation
A short-lived “admin” account is spun up solely to bootstrap a new organization.
Authenticate Temp Account
The temp account authenticates via Client API to obtain an access_token.
Organization Creation
Using the token, the temp account creates the organization (/api/organizations).
A raw 32-byte organization key (org key) is generated at this step.
Invite Real Owner
Temp account sends an invite (/api/organizations/:id/invite) to the intended real owner’s email.
Real Owner Registers
Owner accepts the invite, sets a master password, and generates their RSA keypair (public/private).
Automated Confirmation + akey Injection
If invited_by_email matches the temp account, the invite is auto-confirmed.
The raw org key is encrypted with the owner’s public key.
The encrypted blob is stored as their akey.
Temp Account Leaves
Once ownership is handed over, the temp account is removed from the org (DELETE /api/organizations/:id).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.