diff --git a/API_DOCUMENTATION.md b/API_DOCUMENTATION.md
index cf801f2a..7a4d7bd1 100644
--- a/API_DOCUMENTATION.md
+++ b/API_DOCUMENTATION.md
@@ -522,7 +522,7 @@ x-application: <application_name>
 ### 4.1 Create Organisation User
 **Endpoint:** `POST /organisation/user/create`
 
-**Description:** Adds a user to an organisation with specified access level.
+**Description:** Adds a user to an organisation with specified access level. If the user exists in the system, they are immediately added to the organization. If the user doesn't exist, an invitation is created and sent via email with a secure token that the user can use to accept the invitation.
 
 **Headers:**
 ```json
@@ -557,16 +557,45 @@ x-application: <application_name>
 {
   "type": "object",
   "properties": {
+    "user": {
+      "type": "string",
+      "description": "Username that was processed"
+    },
     "success": {
-      "type": "boolean"
+      "type": "boolean",
+      "description": "Whether the operation was successful"
     },
-    "message": {
-      "type": "string"
+    "operation": {
+      "type": "string",
+      "enum": ["add", "invite_created", "invite_updated"],
+      "description": "Type of operation performed"
     }
   }
 }
 ```
 
+**Operation Types:**
+- `add`: User existed and was directly added to the organization
+- `invite_created`: User didn't exist, new invitation was created and email sent
+- `invite_updated`: User didn't exist but had a pending invite, existing invite was updated and email re-sent
+
+**Example Responses:**
+```json
+{
+  "user": "existing_user",
+  "success": true,
+  "operation": "add"
+}
+```
+
+```json
+{
+  "user": "new_user@example.com", 
+  "success": true,
+  "operation": "invite_created"
+}
+```
+
 ### 4.2 Update Organisation User
 **Endpoint:** `POST /organisation/user/update`
 
@@ -697,9 +726,273 @@ x-application: <application_name>
 
 ---
 
-## 5. File Management
+## 5. Invite Management
+
+### 5.1 Accept Organization Invite
+**Endpoint:** `POST /organisation/user/invite/accept`
+
+**Description:** Accepts an organization invitation using an invite token. The authenticated user will be added to the organization with the role specified in the invite.
+
+**Headers:**
+```json
+{
+  "Content-Type": "application/json",
+  "Authorization": "Bearer <jwt_token>"
+}
+```
+
+**Request Body Schema:**
+```json
+{
+  "type": "object",
+  "properties": {
+    "token": {
+      "type": "string",
+      "description": "Invite token received via email"
+    }
+  },
+  "required": ["token"]
+}
+```
+
+**Response Schema:**
+```json
+{
+  "type": "object",
+  "properties": {
+    "success": {
+      "type": "boolean",
+      "description": "Whether the invite was accepted successfully"
+    },
+    "message": {
+      "type": "string",
+      "description": "Success message"
+    },
+    "organization": {
+      "type": "string",
+      "description": "Organization name that was joined"
+    },
+    "role": {
+      "type": "string",
+      "enum": ["admin", "write", "read"],
+      "description": "Role assigned in the organization"
+    }
+  }
+}
+```
+
+**Example Response:**
+```json
+{
+  "success": true,
+  "message": "Successfully joined organization my-company as admin",
+  "organization": "my-company",
+  "role": "admin"
+}
+```
+
+**Error Cases:**
+- `400 Bad Request`: Invalid or expired invite token
+- `401 Unauthorized`: Missing authentication or invite email doesn't match authenticated user
+- `404 Not Found`: User not found in system
+- `500 Internal Server Error`: Failed to add user to organization
+
+### 5.2 List Organization Invites
+**Endpoint:** `GET /organisation/user/invite/list`
+
+**Description:** Lists all invites for the authenticated user's organization with search and pagination capabilities. Requires WRITE permission for the organization.
+
+**Headers:**
+```json
+{
+  "Content-Type": "application/json",
+  "Authorization": "Bearer <jwt_token>",
+  "x-organisation": "<organisation_name>"
+}
+```
+
+**Query Parameters:**
+- `search` (optional): Search term for email or role filtering
+- `status` (optional): Filter by invite status (`pending`, `accepted`, `declined`, `expired`)
+- `page` (optional): Page number (default: 1)
+- `per_page` (optional): Items per page (default: 10, max: 100)
+
+**Response Schema:**
+```json
+{
+  "type": "object",
+  "properties": {
+    "invites": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Invite UUID"
+          },
+          "email": {
+            "type": "string",
+            "description": "Email address of invitee"
+          },
+          "role": {
+            "type": "string",
+            "enum": ["admin", "write", "read"],
+            "description": "Role to be assigned"
+          },
+          "status": {
+            "type": "string",
+            "enum": ["pending", "accepted", "declined", "expired"],
+            "description": "Current invite status"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "When the invite was created/last updated"
+          }
+        }
+      }
+    },
+    "pagination": {
+      "type": "object",
+      "properties": {
+        "current_page": {
+          "type": "integer",
+          "description": "Current page number"
+        },
+        "per_page": {
+          "type": "integer",
+          "description": "Items per page"
+        },
+        "total_items": {
+          "type": "integer",
+          "description": "Total number of invites"
+        },
+        "total_pages": {
+          "type": "integer",
+          "description": "Total number of pages"
+        }
+      }
+    }
+  }
+}
+```
+
+**Example Response:**
+```json
+{
+  "invites": [
+    {
+      "id": "550e8400-e29b-41d4-a716-446655440000",
+      "email": "user@example.com",
+      "role": "admin",
+      "status": "pending",
+      "created_at": "2025-11-03T10:30:00Z"
+    }
+  ],
+  "pagination": {
+    "current_page": 1,
+    "per_page": 10,
+    "total_items": 1,
+    "total_pages": 1
+  }
+}
+```
+
+**Example Usage:**
+- List all invites: `GET /organisation/user/invite/list`
+- Search by email: `GET /organisation/user/invite/list?search=john@example.com`
+- Filter pending invites: `GET /organisation/user/invite/list?status=pending`
+- Search admin roles: `GET /organisation/user/invite/list?search=admin`
+- Paginated results: `GET /organisation/user/invite/list?page=2&per_page=20`
+
+### 5.3 Revoke Organization Invite
+**Endpoint:** `POST /organisation/user/invite/{invite_id}/revoke`
+
+**Description:** Revokes (expires) an existing organization invite. Requires WRITE permission for the organization. Only invites belonging to the authenticated user's organization can be revoked.
+
+**Headers:**
+```json
+{
+  "Content-Type": "application/json",
+  "Authorization": "Bearer <jwt_token>",
+  "x-organisation": "<organisation_name>"
+}
+```
+
+**Path Parameters:**
+- `invite_id`: UUID of the invite to revoke
+
+**Response Schema:**
+```json
+{
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "description": "Invite UUID"
+    },
+    "org_id": {
+      "type": "string",
+      "description": "Organization ID"
+    },
+    "email": {
+      "type": "string",
+      "description": "Email address of invitee"
+    },
+    "role": {
+      "type": "string",
+      "enum": ["admin", "write", "read"],
+      "description": "Role that was to be assigned"
+    },
+    "status": {
+      "type": "string",
+      "value": "expired",
+      "description": "Updated status (will be 'expired')"
+    },
+    "token": {
+      "type": "string",
+      "description": "Invite token (now invalid)"
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When the invite was created"
+    }
+  }
+}
+```
+
+**Error Cases:**
+- `400 Bad Request`: Invalid invite ID format
+- `403 Forbidden`: No permission to revoke invite (not in same organization)
+- `404 Not Found`: Invite not found
+- `500 Internal Server Error`: Database error
+
+**Notes:**
+1. **Invite Tokens**: When users don't exist in the system, the `/create` endpoint now automatically creates database invites with secure tokens and sends email notifications.
+
+2. **Email Integration**: All invite endpoints integrate with the email system using Tera templates. Invite emails include:
+   - Organization name
+   - Role being offered
+   - Secure invite token
+   - Accept link (when implemented in frontend)
+
+3. **Token Expiry**: Invite tokens automatically expire after 7 days from creation. Expired tokens cannot be used to accept invites.
+
+4. **Database-Driven**: All invites are stored in the PostgreSQL database with proper enum types for roles and statuses, ensuring data consistency.
+
+5. **Security Features**:
+   - Tokens are 64-character cryptographically secure random strings
+   - Email verification ensures invites can only be accepted by the intended recipient
+   - JWT authentication required for all operations
+   - Organization-level permissions enforced
+
+---
+
+## 6. File Management
 
-### 5.1 Create File
+### 6.1 Create File
 **Endpoint:** `POST /file`
 
 **Description:** Creates a new file entry by providing a URL.
@@ -782,7 +1075,7 @@ x-application: <application_name>
 }
 ```
 
-### 5.2 Bulk Create Files
+### 6.2 Bulk Create Files
 **Endpoint:** `POST /file/bulk`
 
 **Description:** Creates multiple file entries at once.
@@ -859,7 +1152,7 @@ x-application: <application_name>
 }
 ```
 
-### 5.3 Get File
+### 6.3 Get File
 **Endpoint:** `GET /file`
 
 **Description:** Gets details of a specific file.
@@ -879,7 +1172,7 @@ x-application: <application_name>
 
 **Response Schema:** Same as file creation response.
 
-### 5.4 List Files
+### 6.4 List Files
 **Endpoint:** `GET /file/list`
 
 **Description:** Lists all files for an application with pagination and search.
@@ -924,7 +1217,7 @@ x-application: <application_name>
 }
 ```
 
-### 5.5 Update File Tag
+### 6.5 Update File Tag
 **Endpoint:** `PATCH /file/{file_key}`
 
 **Description:** Updates the tag of an existing file.
@@ -960,9 +1253,9 @@ x-application: <application_name>
 
 ---
 
-## 6. Package Management
+## 7. Package Management
 
-### 6.1 Create Package
+### 7.1 Create Package
 **Endpoint:** `POST /packages`
 
 **Description:** Creates a new package containing multiple files.
@@ -1026,7 +1319,7 @@ x-application: <application_name>
 }
 ```
 
-### 6.2 List Packages
+### 7.2 List Packages
 **Endpoint:** `GET /packages/list`
 
 **Description:** Lists packages for an application with pagination.
@@ -1070,7 +1363,7 @@ x-application: <application_name>
 }
 ```
 
-### 6.3 Get Individual Package
+### 7.3 Get Individual Package
 **Endpoint:** `GET /packages`
 
 **Description:** Gets details of a specific package.
@@ -1114,9 +1407,9 @@ x-application: <application_name>
 
 ---
 
-## 7. Dimension Management
+## 8. Dimension Management
 
-### 7.1 Create Dimension
+### 8.1 Create Dimension
 **Endpoint:** `POST /organisations/applications/dimension/create`
 
 **Description:** Creates a new dimension for application configuration. Supports both standard dimensions and cohort dimensions.
@@ -1215,7 +1508,7 @@ x-application: <application_name>
    }
    ```
 
-### 7.2 List Dimensions
+### 8.2 List Dimensions
 **Endpoint:** `GET /organisations/applications/dimension/list`
 
 **Description:** Lists all dimensions for an application.
@@ -1275,7 +1568,7 @@ x-application: <application_name>
 }
 ```
 
-### 7.3 Update Dimension
+### 8.3 Update Dimension
 **Endpoint:** `PUT /organisations/applications/dimension/{dimension_name}`
 
 **Description:** Updates a dimension's properties.
@@ -1338,7 +1631,7 @@ x-application: <application_name>
 }
 ```
 
-### 7.4 Delete Dimension
+### 8.4 Delete Dimension
 **Endpoint:** `DELETE /organisations/applications/dimension/{dimension_name}`
 
 **Description:** Deletes a dimension from the application.
@@ -1366,11 +1659,11 @@ x-application: <application_name>
 
 ---
 
-## 8. Cohort Dimension Management
+## 9. Cohort Dimension Management
 
 Cohort dimensions allow you to segment users based on version ranges or group memberships. They support both checkpoint-based segmentation (using version comparisons) and group-based segmentation (using explicit member lists).
 
-### 8.1 List Cohort Schema
+### 9.1 List Cohort Schema
 **Endpoint:** `GET /organisations/applications/dimension/{cohort_dimension_name}/cohort`
 
 **Description:** Retrieves the schema and configuration of a cohort dimension.
@@ -1416,7 +1709,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 8.2 Create Cohort Checkpoint
+### 9.2 Create Cohort Checkpoint
 **Endpoint:** `POST /organisations/applications/dimension/{cohort_dimension_name}/cohort/checkpoint`
 
 **Description:** Creates a checkpoint cohort that segments users based on version comparisons (e.g., users with app version >= 2.1.0).
@@ -1475,7 +1768,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 8.3 Create Cohort Group  
+### 9.3 Create Cohort Group  
 **Endpoint:** `POST /organisations/applications/dimension/{cohort_dimension_name}/cohort/group`
 
 **Description:** Creates a group cohort that segments users based on explicit membership lists (e.g., beta testers, VIP users).
@@ -1532,7 +1825,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 8.4 Get Cohort Group Priority
+### 9.4 Get Cohort Group Priority
 **Endpoint:** `GET /organisations/applications/dimension/{cohort_dimension_name}/cohort/group/priority`
 
 **Description:** Retrieves the priority ordering of cohort groups. Groups with lower priority values are evaluated first.
@@ -1566,7 +1859,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 8.5 Update Cohort Group Priority
+### 9.5 Update Cohort Group Priority
 **Endpoint:** `PUT /organisations/applications/dimension/{cohort_dimension_name}/cohort/group/priority`
 
 **Description:** Updates the priority ordering of cohort groups. This affects the order in which groups are evaluated for user segmentation.
@@ -1654,9 +1947,9 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 
 ---
 
-## 9. Release Management
+## 10. Release Management
 
-### 9.1 Create Release
+### 10.1 Create Release
 **Endpoint:** `POST /releases`
 
 **Description:** Creates a new release with configuration and package details.
@@ -1849,7 +2142,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 9.2 List Releases
+### 10.2 List Releases
 **Endpoint:** `GET /releases/list`
 
 **Description:** Lists all releases for an application.
@@ -1894,7 +2187,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 9.3 Get Individual Release
+### 10.3 Get Individual Release
 **Endpoint:** `GET /releases/{release_id}`
 
 **Description:** Gets details of a specific release.
@@ -1986,7 +2279,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 9.4 Ramp Release
+### 10.4 Ramp Release
 **Endpoint:** `POST /releases/{release_id}/ramp`
 
 **Description:** Updates the traffic percentage for a release experiment.
@@ -2045,7 +2338,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 9.5 Conclude Release
+### 10.5 Conclude Release
 **Endpoint:** `POST /releases/{release_id}/conclude`
 
 **Description:** Concludes a release experiment by choosing a winning variant.
@@ -2096,7 +2389,7 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 }
 ```
 
-### 9.6 Serve Release Configuration (Public)
+### 10.6 Serve Release Configuration (Public)
 **Endpoint:** `GET /release/{organisation}/{application}`
 
 **Description:** Public endpoint that serves the live release configuration for client SDKs. No authentication required.
@@ -2203,9 +2496,9 @@ Cohort dimensions allow you to segment users based on version ranges or group me
 
 ---
 
-## 10. Configuration Management
+## 11. Configuration Management
 
-### 10.1 Create Configuration
+### 11.1 Create Configuration
 **Endpoint:** `POST /organisations/applications/config/create`
 
 **Description:** Creates application configuration.
diff --git a/Cargo.lock b/Cargo.lock
index 424fe345..f9c4a2fa 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -302,6 +302,18 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if 1.0.3",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -365,14 +377,17 @@ dependencies = [
  "http-body 1.0.1",
  "jsonwebtoken",
  "keycloak",
+ "lettre",
  "log",
  "r2d2",
+ "rand 0.8.5",
  "reqwest",
  "rustls 0.23.31",
  "serde",
  "serde_json",
  "sha2",
  "superposition_sdk",
+ "tera",
  "thiserror 2.0.16",
  "tokio",
  "tracing",
@@ -423,6 +438,15 @@ version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
+[[package]]
+name = "ar_archive_writer"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c269894b6fe5e9d7ada0cf69b5bf847ff35bc25fc271f08e1d080fce80339a"
+dependencies = [
+ "object 0.32.2",
+]
+
 [[package]]
 name = "arbitrary"
 version = "1.4.2"
@@ -994,7 +1018,7 @@ dependencies = [
  "cfg-if 1.0.3",
  "libc",
  "miniz_oxide",
- "object",
+ "object 0.36.7",
  "rustc-demangle",
  "windows-targets 0.52.6",
 ]
@@ -1102,6 +1126,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234113d19d0d7d613b40e86fb654acf958910802bcceab913a4f9e7cda03b1a4"
 dependencies = [
  "memchr",
+ "serde",
 ]
 
 [[package]]
@@ -1168,7 +1193,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]
 
 [[package]]
@@ -1197,6 +1222,38 @@ dependencies = [
  "windows-link 0.2.0",
 ]
 
+[[package]]
+name = "chrono-tz"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93698b29de5e97ad0ae26447b344c482a7284c737d9ddc5f9e52b74a336671bb"
+dependencies = [
+ "chrono",
+ "chrono-tz-build",
+ "phf",
+]
+
+[[package]]
+name = "chrono-tz-build"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c088aee841df9c3041febbb73934cfc39708749bf96dc827e3359cd39ef11b1"
+dependencies = [
+ "parse-zoneinfo",
+ "phf",
+ "phf_codegen",
+]
+
+[[package]]
+name = "chumsky"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eebd66744a15ded14960ab4ccdbfb51ad3b81f51f3f04a80adac98c985396c9"
+dependencies = [
+ "hashbrown 0.14.5",
+ "stacker",
+]
+
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -1382,6 +1439,25 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.21"
@@ -1571,6 +1647,12 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "deunicode"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04"
+
 [[package]]
 name = "diesel"
 version = "2.2.12"
@@ -1725,6 +1807,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "email-encoding"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9298e6504d9b9e780ed3f7dfd43a61be8cd0e09eb07f7706a945b0072b6670b6"
+dependencies = [
+ "base64 0.22.1",
+ "memchr",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1971,6 +2069,30 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
+[[package]]
+name = "globset"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "log",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "globwalk"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
+dependencies = [
+ "bitflags 2.9.4",
+ "ignore",
+ "walkdir",
+]
+
 [[package]]
 name = "google-apis-common"
 version = "7.0.0"
@@ -2069,6 +2191,16 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -2107,6 +2239,17 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "hostname"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a56f203cd1c76362b69e3863fd987520ac36cf70a8c92627449b2f64a8cf7d65"
+dependencies = [
+ "cfg-if 1.0.3",
+ "libc",
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -2181,6 +2324,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humansize"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7"
+dependencies = [
+ "libm",
+]
+
 [[package]]
 name = "hyper"
 version = "0.14.32"
@@ -2440,6 +2592,22 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "ignore"
+version = "0.4.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
+dependencies = [
+ "crossbeam-deque",
+ "globset",
+ "log",
+ "memchr",
+ "regex-automata",
+ "same-file",
+ "walkdir",
+ "winapi-util",
+]
+
 [[package]]
 name = "impl-more"
 version = "0.1.9"
@@ -2580,6 +2748,31 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "lettre"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e13e10e8818f8b2a60f52cb127041d388b89f3a96a62be9ceaffa22262fef7f"
+dependencies = [
+ "base64 0.22.1",
+ "chumsky",
+ "email-encoding",
+ "email_address",
+ "fastrand",
+ "futures-util",
+ "hostname",
+ "httpdate",
+ "idna",
+ "mime",
+ "native-tls",
+ "nom 8.0.0",
+ "percent-encoding",
+ "quoted_printable",
+ "socket2 0.6.0",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "libbz2-rs-sys"
 version = "0.2.2"
@@ -2642,6 +2835,12 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "libm"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+
 [[package]]
 name = "libz-rs-sys"
 version = "0.5.2"
@@ -2851,6 +3050,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.1"
@@ -2925,6 +3133,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "object"
+version = "0.32.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "object"
 version = "0.36.7"
@@ -3046,6 +3263,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "487f2ccd1e17ce8c1bfab3a65c89525af41cfad4c8659021a1e9a2aacd73b89b"
 
+[[package]]
+name = "parse-zoneinfo"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24"
+dependencies = [
+ "regex",
+]
+
 [[package]]
 name = "pbkdf2"
 version = "0.12.2"
@@ -3072,6 +3298,87 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "pest"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "989e7521a040efde50c3ab6bbadafbe15ab6dc042686926be59ac35d74607df4"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "187da9a3030dbafabbbfb20cb323b976dc7b7ce91fcd84f2f74d6e31d378e2de"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49b401d98f5757ebe97a26085998d6c0eecec4995cad6ab7fc30ffdf4b052843"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f27a2cfee9f9039c4d86faa5af122a0ac3851441a34865b8a043b46be0065a"
+dependencies = [
+ "pest",
+ "sha2",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project"
 version = "1.1.10"
@@ -3236,6 +3543,16 @@ version = "2.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
 
+[[package]]
+name = "psm"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d11f2fedc3b7dafdc2851bc52f277377c5473d378859be234bc7ebb593144d01"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -3245,6 +3562,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "quoted_printable"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "640c9bd8497b02465aeef5375144c26062e0dcd5939dfcbb0f5db76cb8c17c73"
+
 [[package]]
 name = "r-efi"
 version = "5.3.0"
@@ -3646,6 +3969,15 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "sasl2-sys"
 version = "0.1.22+2.1.28"
@@ -4021,12 +4353,28 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+
 [[package]]
 name = "slab"
 version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
+[[package]]
+name = "slug"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "882a80f72ee45de3cc9a5afeb2da0331d58df69e4e7d8eeb5d3c7784ae67e724"
+dependencies = [
+ "deunicode",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -4075,6 +4423,19 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
 
+[[package]]
+name = "stacker"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1f8b29fb42aafcea4edeeb6b2f2d7ecd0d969c48b4cf0d2e64aafc471dd6e59"
+dependencies = [
+ "cc",
+ "cfg-if 1.0.3",
+ "libc",
+ "psm",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -4195,6 +4556,28 @@ dependencies = [
  "windows-sys 0.61.0",
 ]
 
+[[package]]
+name = "tera"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8004bca281f2d32df3bacd59bc67b312cb4c70cea46cbd79dbe8ac5ed206722"
+dependencies = [
+ "chrono",
+ "chrono-tz",
+ "globwalk",
+ "humansize",
+ "lazy_static",
+ "percent-encoding",
+ "pest",
+ "pest_derive",
+ "rand 0.8.5",
+ "regex",
+ "serde",
+ "serde_json",
+ "slug",
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -4613,6 +4996,12 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
 [[package]]
 name = "unicase"
 version = "2.8.1"
@@ -4625,6 +5014,12 @@ version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -4713,6 +5108,16 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -4841,6 +5246,15 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.0",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.61.2"
diff --git a/airborne_dashboard/app/dashboard/[orgId]/[appId]/users/page.tsx b/airborne_dashboard/app/dashboard/[orgId]/[appId]/users/page.tsx
index 411b0b29..ae68aac8 100644
--- a/airborne_dashboard/app/dashboard/[orgId]/[appId]/users/page.tsx
+++ b/airborne_dashboard/app/dashboard/[orgId]/[appId]/users/page.tsx
@@ -1,18 +1,35 @@
 "use client";
+import { useState } from "react";
 import useSWR from "swr";
 import { apiFetch } from "@/lib/api";
 import { useAppContext } from "@/providers/app-context";
-import { UserManagement, type AccessLevel, type User } from "@/components/user-management";
+import { canUpdateUsers, UserManagement, type AccessLevel, type User } from "@/components/user-management";
+import { ApplicationAccessModal } from "@/components/application-access-modal";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Users, Building2 } from "lucide-react";
+import { toastSuccess, toastError } from "@/hooks/use-toast";
+import { useRouter } from "next/navigation";
 
 type OrgUsers = { users: User[] };
 
 export default function ApplicationUsersPage() {
   const { token, org, app, getAppAccess, getOrgAccess, updateOrgs } = useAppContext();
-  const { data, error, mutate } = useSWR<OrgUsers>(
+  const router = useRouter();
+  const [isAppAccessModalOpen, setIsAppAccessModalOpen] = useState(false);
+
+  // Application users data
+  const { data, isLoading, error, mutate } = useSWR<OrgUsers>(
     token && org ? "/organisations/applications/user/list" : null,
     (url: string) => apiFetch<any>(url, {}, { token, org, app })
   );
 
+  // Organization users data (for the application access modal)
+  const { data: orgUsersData, isLoading: orgUsersLoading } = useSWR<OrgUsers>(
+    token && org ? "/organisations/user/list" : null,
+    (url: string) => apiFetch<any>(url, {}, { token, org })
+  );
+
   const addUser = async (user: string, access: AccessLevel) => {
     await apiFetch(
       "/organisations/applications/user/create",
@@ -39,12 +56,122 @@ export default function ApplicationUsersPage() {
     updateOrgs();
   };
 
+  // Handle application access invites (grant access to existing org users)
+  const handleApplicationInvite = async (invites: { userId: string; role: string }[]) => {
+    try {
+      // Call the API for each user in parallel
+      const promises = invites.map((invite) =>
+        apiFetch(
+          "/organisations/applications/user/create",
+          {
+            method: "POST",
+            body: {
+              user: invite.userId,
+              access: invite.role as AccessLevel,
+            },
+          },
+          { token, org, app }
+        )
+      );
+
+      const results = await Promise.allSettled(promises);
+      const failures = results.filter((r) => r.status === "rejected");
+      const successes = results.filter((r) => r.status === "fulfilled");
+
+      if (failures.length === 0) {
+        toastSuccess(
+          "Access Granted",
+          `Successfully granted ${app} access to ${invites.length} user${invites.length !== 1 ? "s" : ""}`
+        );
+      } else if (successes.length > 0) {
+        toastError("Partial Success", `Granted access to ${successes.length} user(s), but ${failures.length} failed`);
+      } else {
+        throw new Error("All access grants failed");
+      }
+
+      setIsAppAccessModalOpen(false); // Close the modal
+      mutate(); // Refresh the users list
+      updateOrgs(); // Update organizations data
+    } catch (error: any) {
+      console.error("Failed to grant application access:", error);
+      toastError("Failed to Grant Access", error.message || "Could not grant application access");
+    }
+  };
+
+  // Handle redirect to organization users page
+  const handleRedirectToOrgUsers = () => {
+    router.push(`/dashboard/${org}/users`);
+  };
+
+  if (isLoading) {
+    return (
+      <>
+        <div className="p-6">Loading users...</div>
+      </>
+    );
+  }
+
   if (error) {
     return <div className="p-6">Error loading users</div>;
   }
 
+  // Prepare org users for the application access modal (exclude users already in app)
+  const currentAppUsernames = new Set((data?.users || []).map((user) => user.username));
+  const orgUsers =
+    orgUsersData?.users
+      ?.filter((user) => !currentAppUsernames.has(user.username)) // Filter out existing app users
+      ?.map((user) => ({
+        id: user.username,
+        name: user.username,
+        email: user.username, // Assuming username is email for now
+        username: user.username,
+        roles: user.roles,
+      })) || [];
+
+  const canUpdateAppUsers = canUpdateUsers("application", getOrgAccess(org), getAppAccess(org, app));
+  const canUpdateOrgUsers = canUpdateUsers("organisation", getOrgAccess(org), getAppAccess(org, app));
+
   return (
-    <div className="container mx-auto p-6">
+    <div className="container mx-auto p-6 space-y-6">
+      {/* Add User to Application Card */}
+      {(canUpdateAppUsers || canUpdateOrgUsers) && (
+        <Card>
+          <CardHeader>
+            <CardTitle className="flex items-center gap-2">
+              <Users className="h-5 w-5" />
+              Grant Application Access
+            </CardTitle>
+            <p className="text-sm text-muted-foreground">
+              Add existing organization members to this application (excluding current app users)
+            </p>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <div className="flex flex-col sm:flex-row gap-3 sm:justify-start">
+              {canUpdateAppUsers && (
+                <Button onClick={() => setIsAppAccessModalOpen(true)} size="sm" disabled={orgUsers.length === 0}>
+                  <Users className="h-4 w-4 mr-2" />
+                  Add User to Application
+                </Button>
+              )}
+              {canUpdateOrgUsers && (
+                <Button variant="outline" onClick={handleRedirectToOrgUsers} size="sm">
+                  <Building2 className="h-4 w-4 mr-2" />
+                  Add someone to organisation
+                </Button>
+              )}
+            </div>
+            {canUpdateAppUsers && (
+              <p className="text-xs text-muted-foreground">
+                {orgUsers.length === 0
+                  ? "All organization users already have access to this application. Use 'Add someone to organisation' to invite new users."
+                  : `${orgUsers.length} organization member${orgUsers.length !== 1 ? "s" : ""} available to add to this application.`}
+              </p>
+            )}
+          </CardContent>
+        </Card>
+      )}
+
+      {/* Current Application Users */}
       <UserManagement
         users={data?.users || []}
         currentUserAppAccess={getAppAccess(org, app)}
@@ -55,6 +182,18 @@ export default function ApplicationUsersPage() {
         title="Application Users"
         description="Manage users and their access levels for this application"
         entityType="application"
+        hideAddUserButton={true}
+      />
+
+      {/* Application Access Modal */}
+      <ApplicationAccessModal
+        isOpen={isAppAccessModalOpen}
+        onClose={() => setIsAppAccessModalOpen(false)}
+        onSubmit={handleApplicationInvite}
+        orgUsers={orgUsers}
+        applicationName={app || ""}
+        availableRoles={["read", "write", "admin"]}
+        isLoading={orgUsersLoading}
       />
     </div>
   );
diff --git a/airborne_dashboard/app/dashboard/[orgId]/users/page.tsx b/airborne_dashboard/app/dashboard/[orgId]/users/page.tsx
index 704ba522..0c43f310 100644
--- a/airborne_dashboard/app/dashboard/[orgId]/users/page.tsx
+++ b/airborne_dashboard/app/dashboard/[orgId]/users/page.tsx
@@ -1,57 +1,305 @@
 "use client";
+import { useState } from "react";
 import useSWR from "swr";
 import { apiFetch } from "@/lib/api";
+import { listInvites, revokeInvite } from "@/lib/invitation";
 import { useAppContext } from "@/providers/app-context";
 import { UserManagement, type AccessLevel, type User } from "@/components/user-management";
+import { InviteManagement } from "@/components/invite-management";
+import { OrganizationAccessModal } from "@/components/organization-access-modal";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Users, Mail, UserPlus } from "lucide-react";
+import { toastSuccess, toastError } from "@/hooks/use-toast";
 
 type OrgUsers = { users: User[] };
 
 export default function OrganisationUsersPage() {
-  const { token, org, getOrgAccess, updateOrgs } = useAppContext();
-  const { data, error, mutate } = useSWR<OrgUsers>(token && org ? "/organisations/user/list" : null, (url: string) =>
+  const { token, org, getOrgAccess, updateOrgs, organisations, config } = useAppContext();
+  const [activeTab, setActiveTab] = useState("users");
+  const [isOrgAccessModalOpen, setIsOrgAccessModalOpen] = useState(false);
+
+  // Get applications for the current organization
+  const currentOrgData = organisations.find((o) => o.name === org);
+  const availableApplications =
+    currentOrgData?.applications.map((app) => ({
+      id: app.application,
+      name: app.application,
+      description: `Application: ${app.application}`,
+    })) || [];
+
+  // Invitation state
+  const [inviteSearchTerm, setInviteSearchTerm] = useState("");
+  const [inviteStatusFilter, setInviteStatusFilter] = useState("all");
+  const [invitePage, setInvitePage] = useState(1);
+  const [inviteLimit] = useState(10);
+
+  // Users data
+  const {
+    data: usersData,
+    isLoading: usersLoading,
+    error: usersError,
+    mutate: mutateUsers,
+  } = useSWR<OrgUsers>(token && org ? "/organisations/user/list" : null, (url: string) =>
     apiFetch<any>(url, {}, { token, org })
   );
 
+  // Invitations data with pagination and filters
+  const {
+    data: invitesData,
+    isLoading: invitesLoading,
+    error: invitesError,
+    mutate: mutateInvites,
+  } = useSWR(
+    token && org ? `invites-${org}-${invitePage}-${inviteLimit}-${inviteSearchTerm}-${inviteStatusFilter}` : null,
+    () =>
+      listInvites(token!, org!, {
+        page: invitePage,
+        per_page: inviteLimit,
+        search: inviteSearchTerm || undefined,
+        status: inviteStatusFilter !== "all" ? inviteStatusFilter : undefined,
+      }),
+    {
+      refreshInterval: 30000, // Refresh every 30 seconds
+    }
+  );
+
   const addUser = async (user: string, access: AccessLevel) => {
-    await apiFetch("/organisations/user/create", { method: "POST", body: { user, access } }, { token, org });
-    mutate();
+    await apiFetch("/organisations/user/invite", { method: "POST", body: { user, access } }, { token, org });
+    mutateUsers();
     updateOrgs();
   };
 
   const updateUser = async (user: string, access: AccessLevel) => {
     await apiFetch("/organisations/user/update", { method: "POST", body: { user, access } }, { token, org });
-    mutate();
+    mutateUsers();
     updateOrgs();
   };
 
   const removeUser = async (user: string) => {
     await apiFetch("/organisations/user/remove", { method: "POST", body: { user } }, { token, org });
-    mutate();
+    mutateUsers();
     updateOrgs();
   };
 
   const transferOwnership = async (user: string) => {
     await apiFetch("/organisations/user/transfer-ownership", { method: "POST", body: { user } }, { token, org });
-    mutate();
+    mutateUsers();
     updateOrgs();
   };
 
-  if (error) {
+  const handleRevokeInvite = async (inviteId: string) => {
+    try {
+      await revokeInvite(inviteId, token!, org!);
+      toastSuccess("Invitation Revoked", "The invitation has been successfully revoked");
+      mutateInvites();
+    } catch (error: any) {
+      toastError("Failed to Revoke", error.message || "Could not revoke the invitation");
+    }
+  };
+
+  // Handle invitation search with debouncing
+  const handleInviteSearchChange = (search: string) => {
+    setInviteSearchTerm(search);
+    setInvitePage(1); // Reset to first page when searching
+  };
+
+  // Handle status filter change
+  const handleInviteStatusFilterChange = (status: string) => {
+    setInviteStatusFilter(status);
+    setInvitePage(1); // Reset to first page when filtering
+  };
+
+  // Handle page change
+  const handleInvitePageChange = (page: number) => {
+    setInvitePage(page);
+  };
+
+  // Handle organization invites (new functionality)
+  const handleOrganizationInvite = async (invite: {
+    email: string;
+    orgRole: string;
+    applications: { name: string; level: string }[];
+  }) => {
+    try {
+      // Call the invite API with applications field matching backend structure
+      await apiFetch(
+        config?.organisation_invite_enabled ? "/organisations/user/invite" : "/organisations/user/create",
+        {
+          method: "POST",
+          body: {
+            user: invite.email,
+            access: invite.orgRole as AccessLevel,
+            applications: invite.applications, // ApplicationAccess array with name and level
+          },
+        },
+        { token, org }
+      );
+
+      toastSuccess(
+        config?.organisation_invite_enabled ? "User Invited" : "User Added",
+        `Successfully ${config?.organisation_invite_enabled ? "invited" : "added"} ${invite.email} to the organization with access to ${invite.applications.length} application${invite.applications.length !== 1 ? "s" : ""}`
+      );
+
+      setIsOrgAccessModalOpen(false); // Close the modal
+      mutateUsers(); // Refresh the users list
+      mutateInvites(); // Refresh the invites list
+      updateOrgs(); // Update organizations data
+    } catch (error: any) {
+      console.error(`Failed to ${config?.organisation_invite_enabled ? "invite" : "add"} user to organization:`, error);
+      toastError(
+        `Failed to ${config?.organisation_invite_enabled ? "invite" : "add"} User`,
+        error.message ||
+          `Could not ${config?.organisation_invite_enabled ? "invite" : "add"} the user to the organization`
+      );
+    }
+  };
+
+  // Check user permissions
+  const currentUserAccess = getOrgAccess(org);
+  const canManageInvites = currentUserAccess.includes("admin") || currentUserAccess.includes("owner");
+
+  if (usersLoading) {
+    return <div className="p-6">Loading...</div>;
+  }
+
+  if (usersError) {
     return <div className="p-6">Error loading users</div>;
   }
 
   return (
-    <div className="container mx-auto p-6">
-      <UserManagement
-        users={data?.users || []}
-        currentUserOrgAccess={getOrgAccess(org)}
-        onAddUser={addUser}
-        onUpdateUser={updateUser}
-        onRemoveUser={removeUser}
-        onTransferOwnership={transferOwnership}
-        title="Organisation Users"
-        description="Manage users and their access levels for this organisation"
-        entityType="organisation"
+    <div className="container mx-auto p-6 space-y-6">
+      {/* Header */}
+      <div>
+        <h1 className="text-2xl font-bold font-[family-name:var(--font-space-grotesk)]">Organization Management</h1>
+        <p className="text-muted-foreground">Manage users, roles, and invitations for your organization</p>
+      </div>
+
+      {/* Tabs */}
+      <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full">
+        <TabsList
+          className={`grid w-full grid-cols-2 lg:w-[400px] ${!config?.organisation_invite_enabled ? "hidden" : ""}`}
+        >
+          <TabsTrigger value="users" className="flex items-center gap-2">
+            <Users className="h-4 w-4" />
+            Users
+            {usersData?.users && usersData.users.length > 0 && (
+              <span className="ml-1 text-xs bg-blue-100 text-blue-800 px-2 py-0.5 rounded-full font-medium">
+                {usersData.users.length}
+              </span>
+            )}
+          </TabsTrigger>
+          {config?.organisation_invite_enabled && (
+            <TabsTrigger value="invitations" className="flex items-center gap-2">
+              <Mail className="h-4 w-4" />
+              Invitations
+              {invitesData?.pagination && invitesData.pagination.total_items > 0 && (
+                <span className="ml-1 text-xs bg-blue-100 text-blue-800 px-2 py-0.5 rounded-full font-medium">
+                  {invitesData.pagination.total_items}
+                </span>
+              )}
+            </TabsTrigger>
+          )}
+        </TabsList>
+
+        <TabsContent value="users" className="mt-6">
+          {usersLoading ? (
+            <>Loading...</>
+          ) : usersError ? (
+            <Card>
+              <CardContent className="pt-6">
+                <div className="text-center text-muted-foreground">Error loading users. Please try again.</div>
+              </CardContent>
+            </Card>
+          ) : (
+            <div className="space-y-6">
+              {/* Invite to Organization Section */}
+              {canManageInvites && (
+                <Card>
+                  <CardHeader>
+                    <CardTitle className="flex items-center gap-2">
+                      <UserPlus className="h-5 w-5" />
+                      Add New Users
+                    </CardTitle>
+                    <CardDescription>Add new users to this organization with application access</CardDescription>
+                  </CardHeader>
+                  <CardContent>
+                    <Button onClick={() => setIsOrgAccessModalOpen(true)}>
+                      <UserPlus className="h-4 w-4 mr-2" />
+                      Add User to Organisation
+                    </Button>
+                  </CardContent>
+                </Card>
+              )}
+
+              {/* Organization Users Management */}
+              <UserManagement
+                users={usersData?.users || []}
+                currentUserOrgAccess={currentUserAccess}
+                onAddUser={addUser}
+                onUpdateUser={updateUser}
+                onRemoveUser={removeUser}
+                onTransferOwnership={transferOwnership}
+                onInviteCreated={() => mutateInvites()}
+                title="Organization Users"
+                description="Manage users and their access levels for this organization"
+                entityType="organisation"
+                hideAddUserButton={true}
+              />
+            </div>
+          )}
+        </TabsContent>
+
+        {config?.organisation_invite_enabled && (
+          <TabsContent value="invitations" className="mt-6">
+            {!canManageInvites ? (
+              <Card>
+                <CardHeader>
+                  <CardTitle>Access Restricted</CardTitle>
+                  <CardDescription>You need admin or owner permissions to manage invitations.</CardDescription>
+                </CardHeader>
+              </Card>
+            ) : invitesLoading ? (
+              <Card>
+                <CardContent className="pt-6">
+                  <div className="text-center text-muted-foreground">Loading invitations...</div>
+                </CardContent>
+              </Card>
+            ) : invitesError ? (
+              <Card>
+                <CardContent className="pt-6">
+                  <div className="text-center text-muted-foreground">Error loading invitations. Please try again.</div>
+                </CardContent>
+              </Card>
+            ) : (
+              <InviteManagement
+                data={invitesData}
+                onRevokeInvite={handleRevokeInvite}
+                onRefresh={() => mutateInvites()}
+                onSearchChange={handleInviteSearchChange}
+                onStatusFilterChange={handleInviteStatusFilterChange}
+                onPageChange={handleInvitePageChange}
+                searchTerm={inviteSearchTerm}
+                statusFilter={inviteStatusFilter}
+                isLoading={invitesLoading}
+                showInviteButtons={false}
+                entityType="organization"
+                organizationName={org || ""}
+                applications={availableApplications}
+              />
+            )}
+          </TabsContent>
+        )}
+      </Tabs>
+
+      {/* Organization Access Modal */}
+      <OrganizationAccessModal
+        isOpen={isOrgAccessModalOpen}
+        onClose={() => setIsOrgAccessModalOpen(false)}
+        onSubmit={handleOrganizationInvite}
+        applications={availableApplications}
+        organizationName={org || ""}
       />
     </div>
   );
diff --git a/airborne_dashboard/app/invitation/[inviteToken]/page.tsx b/airborne_dashboard/app/invitation/[inviteToken]/page.tsx
new file mode 100644
index 00000000..191fc7a0
--- /dev/null
+++ b/airborne_dashboard/app/invitation/[inviteToken]/page.tsx
@@ -0,0 +1,399 @@
+"use client";
+
+import type React from "react";
+import { useState, useEffect } from "react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { Separator } from "@/components/ui/separator";
+import { AlertCircle, Mail, Building, UserCheck, UserX, Loader2 } from "lucide-react";
+import Link from "next/link";
+import Image from "next/image";
+import {
+  validateInviteToken as apiValidateInviteToken,
+  acceptInvite as apiAcceptInvite,
+  declineInvite as apiDeclineInvite,
+} from "@/lib/invitation";
+import { useAppContext } from "@/providers/app-context";
+import { toastSuccess, toastError } from "@/hooks/use-toast";
+import { useRouter, useParams } from "next/navigation";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+
+interface InviteDetails {
+  invite_id: string;
+  email: string;
+  organization: string;
+  role: string;
+  status: string;
+  created_at: string;
+  inviter?: string;
+}
+
+type InviteStatus = "loading" | "valid" | "invalid" | "expired" | "accepted" | "permission_denied";
+
+export default function InvitationPage() {
+  const router = useRouter();
+  const params = useParams();
+  const { user, token, updateOrgs, config } = useAppContext();
+  const [inviteStatus, setInviteStatus] = useState<InviteStatus>("loading");
+  const [inviteDetails, setInviteDetails] = useState<InviteDetails | null>(null);
+  const [isAccepting, setIsAccepting] = useState(false);
+  const [isRejecting, setIsRejecting] = useState(false);
+
+  const inviteToken = params?.inviteToken as string;
+
+  useEffect(() => {
+    if (!inviteToken) {
+      setInviteStatus("invalid");
+      return;
+    }
+
+    // Always validate the token first, regardless of auth status
+    validateInviteToken();
+  }, [inviteToken, token, user]);
+
+  const validateInviteToken = async () => {
+    try {
+      const details = await apiValidateInviteToken(inviteToken, token || undefined);
+
+      // For authenticated users, check if the invite is for their email
+      if (token && user && details.email !== user.name) {
+        setInviteStatus("permission_denied");
+        return;
+      }
+
+      setInviteStatus("valid");
+      setInviteDetails(details);
+    } catch (error: any) {
+      console.error("Invite validation error:", error);
+
+      if (error.message?.includes("expired")) {
+        setInviteStatus("expired");
+      } else if (error.message?.includes("Invalid")) {
+        setInviteStatus("invalid");
+      } else if (error.status === 404) {
+        setInviteStatus("invalid");
+      } else {
+        setInviteStatus("invalid");
+      }
+    }
+  };
+
+  const handleAcceptInvite = async () => {
+    if (!inviteToken || !token || !inviteDetails?.invite_id) return;
+
+    setIsAccepting(true);
+    try {
+      const response = await apiAcceptInvite(inviteDetails.invite_id, inviteToken, token);
+
+      toastSuccess("Invitation Accepted", response.message);
+
+      // Refresh organizations list before redirecting
+      await updateOrgs();
+
+      // Redirect to dashboard or organization page
+      router.push("/dashboard");
+    } catch (error: any) {
+      console.error("Accept invite error:", error);
+      toastError("Failed to Accept", error.message || "Could not accept invitation");
+    } finally {
+      setIsAccepting(false);
+    }
+  };
+
+  const handleDeclineInvite = async () => {
+    if (!inviteToken || !token || !inviteDetails?.invite_id) return;
+
+    setIsRejecting(true);
+    try {
+      const response = await apiDeclineInvite(inviteDetails.invite_id, inviteToken, token);
+
+      toastSuccess("Invitation Declined", response.message);
+
+      // Redirect to dashboard
+      router.push("/dashboard");
+    } catch (error: any) {
+      console.error("Decline invite error:", error);
+      toastError("Failed to Decline", error.message || "Could not decline invitation");
+    } finally {
+      setIsRejecting(false);
+    }
+  };
+
+  const getRoleColor = (role: string) => {
+    switch (role.toLowerCase()) {
+      case "admin":
+        return "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200";
+      case "write":
+        return "bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200";
+      case "read":
+        return "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200";
+      default:
+        return "bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-200";
+    }
+  };
+
+  // Loading state
+  if (inviteStatus === "loading") {
+    return (
+      <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+        <Card className="w-full max-w-md">
+          <CardContent className="flex flex-col items-center justify-center py-12">
+            <Loader2 className="h-8 w-8 animate-spin text-primary mb-4" />
+            <p className="text-muted-foreground">Validating invitation...</p>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  // Error states
+  if (inviteStatus === "invalid" || inviteStatus === "expired" || inviteStatus === "permission_denied") {
+    return (
+      <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+        <Card className="w-full max-w-md">
+          <CardHeader className="text-center">
+            <div className="mx-auto mb-4 h-12 w-12 rounded-full bg-destructive/10 flex items-center justify-center">
+              <AlertCircle className="h-6 w-6 text-destructive" />
+            </div>
+            <CardTitle className="text-xl">
+              {inviteStatus === "expired" && "Invitation Expired"}
+              {inviteStatus === "invalid" && "Invalid Invitation"}
+              {inviteStatus === "permission_denied" && "Access Denied"}
+            </CardTitle>
+            <CardDescription>
+              {inviteStatus === "expired" && "This invitation link has expired and is no longer valid."}
+              {inviteStatus === "invalid" && "This invitation link is invalid or has already been used."}
+              {inviteStatus === "permission_denied" && "This invitation is not for your account."}
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="text-center">
+            <Button asChild variant="outline">
+              <Link href="/dashboard">Go to Dashboard</Link>
+            </Button>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  // Feature not available
+  if (config?.organisation_invite_enabled === false) {
+    return (
+      <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+        <Card className="w-full max-w-md">
+          <CardHeader className="text-center">
+            <div className="mx-auto mb-4 h-12 w-12 rounded-full bg-destructive/10 flex items-center justify-center">
+              <AlertCircle className="h-6 w-6 text-destructive" />
+            </div>
+            <CardTitle className="text-xl">Not available</CardTitle>
+            <CardDescription>
+              The resource you were requesting for is not available due to configuration settings.
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="text-center">
+            <Button asChild variant="outline">
+              <Link href="/dashboard">Go to Dashboard</Link>
+            </Button>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  // Already accepted state
+  if (inviteStatus === "accepted") {
+    return (
+      <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+        <Card className="w-full max-w-md">
+          <CardHeader className="text-center">
+            <div className="mx-auto mb-4 h-12 w-12 rounded-full bg-green-100 dark:bg-green-900 flex items-center justify-center">
+              <UserCheck className="h-6 w-6 text-green-600 dark:text-green-400" />
+            </div>
+            <CardTitle className="text-xl">Already accepted</CardTitle>
+            <CardDescription>This invitation is already accepted.</CardDescription>
+          </CardHeader>
+          <CardContent className="text-center">
+            <Button asChild>
+              <Link href="/dashboard">Go to Dashboard</Link>
+            </Button>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  // Valid invite - show accept/decline UI
+  return (
+    <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+      <div className="w-full max-w-lg">
+        {/* Header with logo */}
+        <div className="text-center mb-8">
+          <div className="inline-flex items-center gap-3 mb-4">
+            <div className="h-16 rounded-xl flex items-center justify-center">
+              <Image
+                src="/airborne-logo-light.svg"
+                alt="Airborne Logo"
+                width={32}
+                height={14}
+                className="w-32 text-primary-foreground dark:hidden"
+              />
+              <Image
+                src="/airborne-logo-dark.svg"
+                alt="Airborne Logo"
+                width={32}
+                height={14}
+                className="w-32 text-primary-foreground hidden dark:block"
+              />
+            </div>
+          </div>
+        </div>
+
+        <Card className="border-0 shadow-lg">
+          <CardHeader className="text-center pb-4">
+            <div className="mx-auto mb-4 h-16 w-16 rounded-full bg-primary/10 flex items-center justify-center">
+              <Building className="h-8 w-8 text-primary" />
+            </div>
+            <CardTitle className="text-2xl font-[family-name:var(--font-space-grotesk)]">
+              Organization Invitation
+            </CardTitle>
+            <CardDescription className="text-base">You&rsquo;ve been invited to join an organization</CardDescription>
+          </CardHeader>
+
+          <CardContent className="space-y-6">
+            {/* Invitation Details */}
+            <div className="space-y-4">
+              <Alert>
+                <Mail className="h-4 w-4" />
+                <AlertDescription>
+                  <div className="space-y-2">
+                    <div className="flex items-center justify-between">
+                      <span className="text-sm text-muted-foreground">Organization:</span>
+                      <span className="font-semibold">{inviteDetails?.organization}</span>
+                    </div>
+                    <div className="flex items-center justify-between">
+                      <span className="text-sm text-muted-foreground">Role:</span>
+                      <Badge className={getRoleColor(inviteDetails?.role || "")}>{inviteDetails?.role}</Badge>
+                    </div>
+                    <div className="flex items-center justify-between">
+                      <span className="text-sm text-muted-foreground">Invited email:</span>
+                      <span className="font-mono text-sm">{inviteDetails?.email}</span>
+                    </div>
+                  </div>
+                </AlertDescription>
+              </Alert>
+
+              {/* Role Description */}
+              <div className="text-sm text-muted-foreground bg-muted/50 rounded-lg p-4">
+                <p className="font-medium mb-2">This role will give you:</p>
+                <ul className="space-y-1">
+                  {inviteDetails?.role === "admin" && (
+                    <>
+                      <li>• Full administrative access</li>
+                      <li>• Manage users and permissions</li>
+                      <li>• Create and manage applications</li>
+                      <li>• Access to all organization features</li>
+                    </>
+                  )}
+                  {inviteDetails?.role === "write" && (
+                    <>
+                      <li>• Create and edit applications</li>
+                      <li>• Manage deployments and releases</li>
+                      <li>• View analytics and reports</li>
+                      <li>• Collaborate with team members</li>
+                    </>
+                  )}
+                  {inviteDetails?.role === "read" && (
+                    <>
+                      <li>• View applications and data</li>
+                      <li>• Access analytics and reports</li>
+                      <li>• Download deployment artifacts</li>
+                      <li>• View team activity</li>
+                    </>
+                  )}
+                </ul>
+              </div>
+            </div>
+
+            <Separator />
+
+            {/* Action buttons */}
+            {token && user ? (
+              // Authenticated user - show accept/decline buttons
+              <div className="flex flex-col sm:flex-row gap-3">
+                <Button onClick={handleAcceptInvite} disabled={isAccepting || isRejecting} className="flex-1 h-11">
+                  {isAccepting ? (
+                    <>
+                      <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                      Accepting...
+                    </>
+                  ) : (
+                    <>
+                      <UserCheck className="mr-2 h-4 w-4" />
+                      Accept Invitation
+                    </>
+                  )}
+                </Button>
+
+                <Button
+                  variant="outline"
+                  onClick={handleDeclineInvite}
+                  disabled={isAccepting || isRejecting}
+                  className="flex-1 h-11"
+                >
+                  {isRejecting ? (
+                    <>
+                      <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                      Declining...
+                    </>
+                  ) : (
+                    <>
+                      <UserX className="mr-2 h-4 w-4" />
+                      Decline
+                    </>
+                  )}
+                </Button>
+              </div>
+            ) : (
+              // Non-authenticated user - show login/register options
+              <div className="space-y-4">
+                <div className="text-center text-sm text-muted-foreground">
+                  <p>To accept this invitation, you need to sign in or create an account.</p>
+                </div>
+                <div className="flex flex-col sm:flex-row gap-3">
+                  <Button asChild className="flex-1 h-11">
+                    <Link
+                      href={`/login?invite_token=${inviteToken}&email=${encodeURIComponent(inviteDetails?.email || "")}&redirect_to=${encodeURIComponent(`/invitation/${inviteToken}`)}`}
+                    >
+                      Sign In
+                    </Link>
+                  </Button>
+
+                  <Button asChild variant="outline" className="flex-1 h-11">
+                    <Link
+                      href={`/register?invite_token=${inviteToken}&redirect_to=${encodeURIComponent(`/invitation/${inviteToken}`)}`}
+                    >
+                      Create Account
+                    </Link>
+                  </Button>
+                </div>
+              </div>
+            )}
+
+            {/* Footer */}
+            {token && user && (
+              <div className="text-center text-sm text-muted-foreground">
+                <p>
+                  Not {user?.name}?{" "}
+                  <Link href="/login" className="text-primary hover:underline">
+                    Sign in with a different account
+                  </Link>
+                </p>
+              </div>
+            )}
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
diff --git a/airborne_dashboard/app/invitation/not-found.tsx b/airborne_dashboard/app/invitation/not-found.tsx
new file mode 100644
index 00000000..89afc528
--- /dev/null
+++ b/airborne_dashboard/app/invitation/not-found.tsx
@@ -0,0 +1,83 @@
+"use client";
+
+import type React from "react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { AlertCircle } from "lucide-react";
+import Link from "next/link";
+import Image from "next/image";
+
+export default function InvitationNotFound() {
+  return (
+    <div className="min-h-screen bg-gradient-to-br from-background via-background to-primary/5 flex items-center justify-center p-4">
+      <div className="w-full max-w-lg">
+        {/* Header with logo */}
+        <div className="text-center mb-8">
+          <div className="inline-flex items-center gap-3 mb-4">
+            <div className="h-16 rounded-xl flex items-center justify-center">
+              <Image
+                src="/airborne-logo-light.svg"
+                alt="Airborne Logo"
+                width={32}
+                height={14}
+                className="w-32 text-primary-foreground dark:hidden"
+              />
+              <Image
+                src="/airborne-logo-dark.svg"
+                alt="Airborne Logo"
+                width={32}
+                height={14}
+                className="w-32 text-primary-foreground hidden dark:block"
+              />
+            </div>
+          </div>
+        </div>
+
+        <Card className="border-0 shadow-lg">
+          <CardHeader className="text-center pb-4">
+            <div className="mx-auto mb-4 h-16 w-16 rounded-full bg-destructive/10 flex items-center justify-center">
+              <AlertCircle className="h-8 w-8 text-destructive" />
+            </div>
+            <CardTitle className="text-2xl font-[family-name:var(--font-space-grotesk)]">
+              Invitation Not Found
+            </CardTitle>
+            <CardDescription className="text-base">
+              The invitation you&rsquo;re looking for doesn&rsquo;t exist or has been removed.
+            </CardDescription>
+          </CardHeader>
+
+          <CardContent className="space-y-6 text-center">
+            <div className="text-sm text-muted-foreground space-y-2">
+              <p>This invitation link may be:</p>
+              <ul className="text-left max-w-sm mx-auto space-y-1">
+                <li>• Invalid or malformed</li>
+                <li>• Already used or accepted</li>
+                <li>• Expired or revoked</li>
+                <li>• From an older system version</li>
+              </ul>
+            </div>
+
+            <div className="flex flex-col sm:flex-row gap-3 justify-center">
+              <Button asChild>
+                <Link href="/dashboard">Go to Dashboard</Link>
+              </Button>
+
+              <Button asChild variant="outline">
+                <Link href="/login">Sign In</Link>
+              </Button>
+            </div>
+
+            <div className="text-center text-sm text-muted-foreground">
+              <p>
+                Need help?{" "}
+                <Link href="mailto:superposition@juspay.in" className="text-primary hover:underline">
+                  Contact support
+                </Link>
+              </p>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
diff --git a/airborne_dashboard/app/login/page.tsx b/airborne_dashboard/app/login/page.tsx
index dd183126..c5b7129b 100644
--- a/airborne_dashboard/app/login/page.tsx
+++ b/airborne_dashboard/app/login/page.tsx
@@ -8,12 +8,13 @@ import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Separator } from "@/components/ui/separator";
 import { Checkbox } from "@/components/ui/checkbox";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
 import { Mail, Lock, Eye, EyeOff } from "lucide-react";
 import Link from "next/link";
 import Image from "next/image";
 import { apiFetch } from "@/lib/api";
 import { useAppContext } from "@/providers/app-context";
-import { useRouter } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
 
 export default function LoginPage() {
   const [name, setName] = useState(""); // API expects "name"
@@ -23,13 +24,46 @@ export default function LoginPage() {
   const [isLoading, setIsLoading] = useState(false);
   const { setToken, setUser, setOrg: setOrganisation, setApp: setApplication, token, config } = useAppContext();
   const router = useRouter();
+  const searchParams = useSearchParams();
+
+  // Get URL parameters for invite flow
+  const inviteToken = searchParams.get("invite_token");
+  const redirectTo = searchParams.get("redirect_to");
+  const inviteEmail = searchParams.get("email");
+
+  const isValidRedirectUrl = (url: string): boolean => {
+    // Only allow relative URLs or same-origin URLs
+    try {
+      const decoded = decodeURIComponent(url);
+      if (decoded.startsWith("/") && !decoded.startsWith("//")) {
+        return true;
+      }
+      const parsedUrl = new URL(decoded, window.location.origin);
+      return parsedUrl.origin === window.location.origin;
+    } catch {
+      return false;
+    }
+  };
+
+  useEffect(() => {
+    // Pre-fill email if coming from invitation
+    if (inviteEmail && !name) {
+      setName(decodeURIComponent(inviteEmail));
+    }
+  }, [inviteEmail, name]);
 
   useEffect(() => {
     if (token && token != "") {
       console.log("Nav to dashboard effect", token);
-      router.replace("/dashboard");
+
+      // If we have a redirect URL (from invitation), go there instead of dashboard
+      if (redirectTo && isValidRedirectUrl(redirectTo)) {
+        router.replace(decodeURIComponent(redirectTo));
+      } else {
+        router.replace("/dashboard");
+      }
     }
-  }, [token, router]);
+  }, [token, router, redirectTo]);
 
   const handleLogin = async (e: React.FormEvent) => {
     e.preventDefault();
@@ -62,6 +96,15 @@ export default function LoginPage() {
       const data = await apiFetch<{ auth_url: string; state?: string }>("/users/oauth/url");
       if (data?.auth_url) {
         localStorage.setItem("oauthAction", "login");
+
+        // Store invite parameters for after OAuth callback
+        if (inviteToken) {
+          localStorage.setItem("oauthInviteToken", inviteToken);
+        }
+        if (redirectTo && isValidRedirectUrl(redirectTo)) {
+          localStorage.setItem("oauthRedirectTo", redirectTo);
+        }
+
         window.location.href = data.auth_url;
       } else {
         throw new Error("OAuth URL not available");
@@ -105,9 +148,28 @@ export default function LoginPage() {
         <Card className="border-0 shadow-lg">
           <CardHeader className="space-y-1 pb-4">
             <CardTitle className="text-xl font-[family-name:var(--font-space-grotesk)]">Sign in</CardTitle>
-            <CardDescription>Enter your credentials to access your account</CardDescription>
+            <CardDescription>
+              {inviteToken
+                ? "Sign in to accept your organization invitation"
+                : "Enter your credentials to access your account"}
+            </CardDescription>
           </CardHeader>
           <CardContent className="space-y-4">
+            {/* Invitation context banner */}
+            {inviteToken && inviteEmail && (
+              <div className="bg-blue-50 dark:bg-blue-950/30 border border-blue-200 dark:border-blue-800 rounded-lg p-4 mb-4">
+                <div className="flex items-start gap-3">
+                  <Mail className="h-5 w-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0" />
+                  <div className="space-y-1">
+                    <p className="text-sm font-medium text-blue-900 dark:text-blue-100">Organization Invitation</p>
+                    <p className="text-sm text-blue-700 dark:text-blue-200">
+                      Sign in with <span className="font-mono font-semibold">{decodeURIComponent(inviteEmail)}</span> to
+                      accept your invitation
+                    </p>
+                  </div>
+                </div>
+              </div>
+            )}
             {/* Google Sign In */}
             {config?.google_signin_enabled && (
               <>
@@ -151,7 +213,10 @@ export default function LoginPage() {
             {/* Email/Password Form */}
             <form onSubmit={handleLogin} className="space-y-4">
               <div className="space-y-2">
-                <Label htmlFor="name">Username</Label>
+                <Label htmlFor="name">
+                  Email
+                  {inviteEmail && <span className="text-xs text-muted-foreground ml-1">(from invitation)</span>}
+                </Label>
                 <div className="relative">
                   <Mail className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-muted-foreground" />
                   <Input
@@ -159,9 +224,25 @@ export default function LoginPage() {
                     placeholder="e.g. alice"
                     value={name}
                     onChange={(e) => setName(e.target.value)}
-                    className="pl-10"
+                    className={`pl-10 ${inviteEmail ? "bg-muted text-muted-foreground cursor-not-allowed" : ""}`}
                     required
+                    readOnly={!!inviteEmail}
+                    disabled={!!inviteEmail}
                   />
+                  {inviteEmail && (
+                    <div className="absolute right-3 top-1/2 transform -translate-y-1/2">
+                      <TooltipProvider>
+                        <Tooltip>
+                          <TooltipTrigger asChild>
+                            <Lock className="h-4 w-4 text-muted-foreground cursor-help" />
+                          </TooltipTrigger>
+                          <TooltipContent>
+                            <p>This email is required for your organization invitation</p>
+                          </TooltipContent>
+                        </Tooltip>
+                      </TooltipProvider>
+                    </div>
+                  )}
                 </div>
               </div>
 
@@ -205,7 +286,14 @@ export default function LoginPage() {
                     Remember me
                   </Label>
                 </div>
-                <Link href="/register" className="text-sm text-primary hover:underline">
+                <Link
+                  href={
+                    inviteToken
+                      ? `/register?invite_token=${inviteToken}&redirect_to=${encodeURIComponent(redirectTo || "/dashboard")}`
+                      : "/register"
+                  }
+                  className="text-sm text-primary hover:underline"
+                >
                   Create account
                 </Link>
               </div>
@@ -217,7 +305,14 @@ export default function LoginPage() {
 
             <div className="text-center text-sm">
               <span className="text-muted-foreground">Don&#39;t have an account? </span>
-              <Link href="/register" className="text-primary hover:underline font-medium">
+              <Link
+                href={
+                  inviteToken
+                    ? `/register?invite_token=${inviteToken}&redirect_to=${encodeURIComponent(redirectTo || "/dashboard")}`
+                    : "/register"
+                }
+                className="text-primary hover:underline font-medium"
+              >
                 Sign up
               </Link>
             </div>
diff --git a/airborne_dashboard/app/oauth/callback/page.tsx b/airborne_dashboard/app/oauth/callback/page.tsx
index 7a1d9323..2c66eda4 100644
--- a/airborne_dashboard/app/oauth/callback/page.tsx
+++ b/airborne_dashboard/app/oauth/callback/page.tsx
@@ -31,7 +31,7 @@ type OAuthPatResponse = {
 export default function OAuthCallback() {
   const params = useSearchParams();
   const router = useRouter();
-  const { setToken, setUser, token, org, app, setOrg, setApp, loading } = useApp();
+  const { setToken, setUser, token, org, app, loading } = useApp();
   const processedCode = useRef(false);
 
   useEffect(() => {
@@ -51,7 +51,7 @@ export default function OAuthCallback() {
       try {
         const endpoint = actionToEndpoint[oauthAction] ?? "/users/oauth/login";
 
-        const res = await apiFetch<OAuthUserResponse | OAuthPatResponse>(
+        let res = await apiFetch<OAuthUserResponse | OAuthPatResponse>(
           endpoint,
           {
             method: "POST",
@@ -72,18 +72,26 @@ export default function OAuthCallback() {
           );
           return;
         }
+        res = res as OAuthUserResponse;
 
-        // normal login/signup flow
-        const userRes = res as OAuthUserResponse;
-        setToken(userRes.user_token?.access_token || "");
-        setUser({ user_id: userRes.user_id, name: userRes.username, is_super_admin: userRes.is_super_admin });
-        const organisation = userRes.organisations?.[0]?.name || "";
-        const application = userRes.organisations?.[0]?.applications?.[0]?.application || "";
-        setOrg(organisation);
-        setApp(application);
-
-        window.location.replace("/dashboard");
-      } catch (e) {
+        console.log("token exchange", oauthAction, res);
+        setToken(res.user_token?.access_token || "");
+        setUser({ user_id: res.user_id, name: res.username, is_super_admin: res.is_super_admin }); // OAuth users will get name from API response
+
+        // Check if we have invite-related redirect parameters stored
+        const storedRedirectTo = localStorage.getItem("oauthRedirectTo");
+
+        // Clean up stored parameters
+        localStorage.removeItem("oauthRedirectTo");
+        localStorage.removeItem("oauthInviteToken");
+
+        // Redirect to invitation page if we came from an invitation, otherwise dashboard
+        if (storedRedirectTo) {
+          window.location.replace(storedRedirectTo);
+        } else {
+          window.location.replace("/dashboard");
+        }
+      } catch (e: any) {
         console.log("Google Callback Error", e);
         router.replace("/login");
       }
diff --git a/airborne_dashboard/app/register/page.tsx b/airborne_dashboard/app/register/page.tsx
index 47ad301a..e1baa46e 100644
--- a/airborne_dashboard/app/register/page.tsx
+++ b/airborne_dashboard/app/register/page.tsx
@@ -9,16 +9,19 @@ import { Label } from "@/components/ui/label";
 import { Separator } from "@/components/ui/separator";
 import { Checkbox } from "@/components/ui/checkbox";
 import { Badge } from "@/components/ui/badge";
-import { Mail, Lock, Eye, EyeOff, User, Check } from "lucide-react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Mail, Lock, Eye, EyeOff, User, Check, UserPlus } from "lucide-react";
 import Link from "next/link";
 import Image from "next/image";
 import { apiFetch } from "@/lib/api";
 import { useAppContext } from "@/providers/app-context";
 import { toastWarning } from "@/hooks/use-toast";
-import { useRouter } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
+import { validateInviteToken } from "@/lib/invitation";
 
 export default function RegisterPage() {
   const router = useRouter();
+  const searchParams = useSearchParams();
   const [formData, setFormData] = useState({
     firstName: "",
     lastName: "",
@@ -33,14 +36,59 @@ export default function RegisterPage() {
   const [isLoading, setIsLoading] = useState(false);
   const { setToken, setUser, token, config } = useAppContext();
 
+  // Invite-related state
+  const [inviteToken, setInviteToken] = useState<string | null>(null);
+  const [redirectTo, setRedirectTo] = useState<string | null>(null);
+  const [inviteInfo, setInviteInfo] = useState<{
+    organization: string;
+    role: string;
+    email: string;
+  } | null>(null);
+  const [isLoadingInvite, setIsLoadingInvite] = useState(false);
+
   useEffect(() => {
     if (token) router.replace("/dashboard");
-  }, [token]);
+
+    // Check for invite token in URL params
+    const inviteTokenParam = searchParams?.get("invite_token");
+    const redirectToParam = searchParams?.get("redirect_to");
+
+    if (inviteTokenParam) {
+      setInviteToken(inviteTokenParam);
+      setRedirectTo(redirectToParam);
+
+      // Fetch invite details to prefill the email
+      fetchInviteDetails(inviteTokenParam);
+    }
+
+    async function fetchInviteDetails(token: string) {
+      setIsLoadingInvite(true);
+      try {
+        const details = await validateInviteToken(token);
+        setInviteInfo({
+          organization: details.organization,
+          role: details.role,
+          email: details.email,
+        });
+
+        // Prefill the email in the form
+        setFormData((prev) => ({
+          ...prev,
+          email: details.email,
+        }));
+      } catch (error) {
+        console.error("Failed to fetch invite details:", error);
+        // If invite is invalid, we can still let them register normally
+      } finally {
+        setIsLoadingInvite(false);
+      }
+    }
+  }, [token, searchParams]);
 
   const handleRegister = async (e: React.FormEvent) => {
     e.preventDefault();
     if (formData.password !== formData.confirmPassword) {
-      toastWarning("Password Mismatch", "Passwords don't match");
+      toastWarning("Password Mismatch", "Passwords don&rsquo;t match");
       return;
     }
     setIsLoading(true);
@@ -53,7 +101,13 @@ export default function RegisterPage() {
       const token = res?.user_token?.access_token || "";
       setToken(token);
       setUser({ user_id: res?.user_id, name: formData.email, is_super_admin: res?.is_super_admin || false });
-      window.location.href = "/dashboard";
+
+      // If there&rsquo;s an invite token, redirect to the invitation page after registration
+      if (inviteToken && redirectTo) {
+        window.location.href = redirectTo;
+      } else {
+        window.location.href = "/dashboard";
+      }
     } catch (e: any) {
       console.log("User Register Error", e);
       // Error toast will be shown automatically by apiFetch
@@ -169,10 +223,42 @@ export default function RegisterPage() {
 
           <Card className="border-0 shadow-lg">
             <CardHeader className="space-y-1 pb-4">
-              <CardTitle className="text-xl font-[family-name:var(--font-space-grotesk)]">Create account</CardTitle>
-              <CardDescription>Get started with your free account</CardDescription>
+              <CardTitle className="text-xl font-[family-name:var(--font-space-grotesk)]">
+                {inviteToken ? "Complete your invitation" : "Create account"}
+              </CardTitle>
+              <CardDescription>
+                {inviteToken
+                  ? "Finish setting up your account to join the organization"
+                  : "Get started with your free account"}
+              </CardDescription>
             </CardHeader>
             <CardContent className="space-y-4">
+              {/* Invite Information */}
+              {inviteToken && (
+                <Alert className="border-primary/20 bg-primary/5">
+                  <UserPlus className="h-4 w-4" />
+                  <AlertDescription>
+                    {isLoadingInvite ? (
+                      <div className="space-y-1">
+                        <p className="font-medium">Loading invitation details...</p>
+                      </div>
+                    ) : inviteInfo ? (
+                      <div className="space-y-1">
+                        <p className="font-medium">You&rsquo;ve been invited to join:</p>
+                        <p className="text-sm">
+                          <strong>{inviteInfo.organization}</strong> as {inviteInfo.role}
+                        </p>
+                        <p className="text-xs text-muted-foreground">Email: {inviteInfo.email}</p>
+                      </div>
+                    ) : (
+                      <div className="space-y-1">
+                        <p className="font-medium">Processing invitation...</p>
+                        <p className="text-sm">Complete registration to join the organization</p>
+                      </div>
+                    )}
+                  </AlertDescription>
+                </Alert>
+              )}
               {/* Google Sign Up */}
               {config?.google_signin_enabled && (
                 <>
@@ -250,10 +336,11 @@ export default function RegisterPage() {
                     <Input
                       id="email"
                       type="email"
-                      placeholder="john@company.com"
+                      placeholder={inviteInfo?.email || "john@company.com"}
                       value={formData.email}
                       onChange={(e) => updateFormData("email", e.target.value)}
                       className="pl-10"
+                      disabled={inviteInfo?.email === formData.email}
                       required
                     />
                   </div>
diff --git a/airborne_dashboard/components/application-access-modal.tsx b/airborne_dashboard/components/application-access-modal.tsx
new file mode 100644
index 00000000..59bfab08
--- /dev/null
+++ b/airborne_dashboard/components/application-access-modal.tsx
@@ -0,0 +1,292 @@
+"use client";
+
+import React, { useState, useEffect } from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Badge } from "@/components/ui/badge";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { Search, Users, Loader2 } from "lucide-react";
+
+interface OrgUser {
+  id: string;
+  name: string;
+  email: string;
+  username: string;
+  roles?: string[];
+}
+
+interface ApplicationAccessInvite {
+  userId: string;
+  role: string;
+}
+
+export interface ApplicationAccessModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onSubmit: (invites: ApplicationAccessInvite[]) => Promise<void>;
+  orgUsers: OrgUser[];
+  applicationName: string;
+  availableRoles?: string[];
+  isLoading?: boolean;
+}
+
+const DEFAULT_ROLES = ["read", "write", "admin"];
+
+const ROLE_COLORS = {
+  admin: "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
+  write: "bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200",
+  read: "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200",
+};
+
+export function ApplicationAccessModal({
+  isOpen,
+  onClose,
+  onSubmit,
+  orgUsers,
+  applicationName,
+  availableRoles = DEFAULT_ROLES,
+  isLoading = false,
+}: ApplicationAccessModalProps) {
+  const [searchTerm, setSearchTerm] = useState("");
+  const [selectedUsers, setSelectedUsers] = useState<Record<string, string>>({});
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  // Reset state when modal opens/closes
+  useEffect(() => {
+    if (!isOpen) {
+      setSearchTerm("");
+      setSelectedUsers({});
+    }
+  }, [isOpen]);
+
+  // Filter users based on search term
+  const filteredUsers = orgUsers.filter(
+    (user) =>
+      user.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
+      user.email.toLowerCase().includes(searchTerm.toLowerCase()) ||
+      user.username.toLowerCase().includes(searchTerm.toLowerCase())
+  );
+
+  const handleUserToggle = (userId: string, checked: boolean) => {
+    if (checked) {
+      setSelectedUsers((prev) => ({ ...prev, [userId]: "read" })); // Default to read role
+    } else {
+      setSelectedUsers((prev) => {
+        const newSelected = { ...prev };
+        delete newSelected[userId];
+        return newSelected;
+      });
+    }
+  };
+
+  const handleRoleChange = (userId: string, role: string) => {
+    setSelectedUsers((prev) => ({ ...prev, [userId]: role }));
+  };
+
+  const handleSelectAll = (checked: boolean) => {
+    if (checked) {
+      const allUsers = filteredUsers.reduce((acc, user) => ({ ...acc, [user.id]: "read" }), {});
+      setSelectedUsers(allUsers);
+    } else {
+      setSelectedUsers({});
+    }
+  };
+
+  const handleSubmit = async () => {
+    const invites = Object.entries(selectedUsers).map(([userId, role]) => ({
+      userId,
+      role,
+    }));
+
+    if (invites.length === 0) {
+      return;
+    }
+
+    setIsSubmitting(true);
+    try {
+      await onSubmit(invites);
+      onClose();
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const selectedCount = Object.keys(selectedUsers).length;
+  const isAllSelected = filteredUsers.length > 0 && filteredUsers.every((user) => selectedUsers[user.id]);
+
+  const getRoleBadge = (role: string) => {
+    const colorClass = ROLE_COLORS[role as keyof typeof ROLE_COLORS] || "bg-gray-100 text-gray-800";
+    return <Badge className={colorClass}>{role.charAt(0).toUpperCase() + role.slice(1)}</Badge>;
+  };
+
+  return (
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="max-w-4xl max-h-[80vh] overflow-hidden flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Users className="h-5 w-5" />
+            Grant Application Access
+          </DialogTitle>
+          <DialogDescription>
+            Select users from your organization to grant access to <strong>{applicationName}</strong>. You can choose
+            different roles for each user.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="flex-1 overflow-hidden flex flex-col gap-4">
+          {/* Search and Select All */}
+          <div className="flex items-center justify-between gap-4">
+            <div className="flex-1">
+              <div className="relative">
+                <Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+                <Input
+                  placeholder="Search users..."
+                  value={searchTerm}
+                  onChange={(e) => setSearchTerm(e.target.value)}
+                  className="pl-9"
+                />
+              </div>
+            </div>
+
+            <div className="flex items-center space-x-2">
+              <Checkbox id="select-all" checked={isAllSelected} onCheckedChange={handleSelectAll} />
+              <Label htmlFor="select-all" className="text-sm font-medium">
+                Select All ({filteredUsers.length})
+              </Label>
+            </div>
+          </div>
+
+          {/* Users Table */}
+          <div className="flex-1 overflow-auto border rounded-lg">
+            <Table>
+              <TableHeader className="sticky top-0 bg-background">
+                <TableRow>
+                  <TableHead className="w-12">Select</TableHead>
+                  <TableHead>User</TableHead>
+                  <TableHead>Email</TableHead>
+                  <TableHead>Current Org Roles</TableHead>
+                  <TableHead className="w-40">App Role</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {isLoading ? (
+                  <TableRow>
+                    <TableCell colSpan={5} className="text-center py-8">
+                      <div className="flex items-center justify-center gap-2">
+                        <Loader2 className="h-4 w-4 animate-spin" />
+                        Loading users...
+                      </div>
+                    </TableCell>
+                  </TableRow>
+                ) : filteredUsers.length === 0 ? (
+                  <TableRow>
+                    <TableCell colSpan={5} className="text-center py-8 text-muted-foreground">
+                      {searchTerm
+                        ? "No users match your search."
+                        : orgUsers.length === 0
+                          ? "All organization users already have access to this application."
+                          : "No users found in this organization."}
+                    </TableCell>
+                  </TableRow>
+                ) : (
+                  filteredUsers.map((user) => {
+                    const isSelected = !!selectedUsers[user.id];
+                    const selectedRole = selectedUsers[user.id];
+
+                    return (
+                      <TableRow key={user.id}>
+                        <TableCell>
+                          <Checkbox
+                            checked={isSelected}
+                            onCheckedChange={(checked) => handleUserToggle(user.id, checked as boolean)}
+                          />
+                        </TableCell>
+                        <TableCell>
+                          <div className="font-medium">{user.name}</div>
+                          <div className="text-sm text-muted-foreground">@{user.username}</div>
+                        </TableCell>
+                        <TableCell className="font-mono text-sm">{user.email}</TableCell>
+                        <TableCell>
+                          <div className="flex gap-1 flex-wrap">
+                            {user.roles?.map((role) => getRoleBadge(role)) || (
+                              <span className="text-sm text-muted-foreground">No roles</span>
+                            )}
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          {isSelected ? (
+                            <Select value={selectedRole} onValueChange={(value) => handleRoleChange(user.id, value)}>
+                              <SelectTrigger className="w-32">
+                                <SelectValue />
+                              </SelectTrigger>
+                              <SelectContent>
+                                {availableRoles.map((role) => (
+                                  <SelectItem key={role} value={role}>
+                                    {role.charAt(0).toUpperCase() + role.slice(1)}
+                                  </SelectItem>
+                                ))}
+                              </SelectContent>
+                            </Select>
+                          ) : (
+                            <span className="text-sm text-muted-foreground">-</span>
+                          )}
+                        </TableCell>
+                      </TableRow>
+                    );
+                  })
+                )}
+              </TableBody>
+            </Table>
+          </div>
+
+          {/* Selected Summary */}
+          {selectedCount > 0 && (
+            <div className="p-3 bg-muted rounded-lg">
+              <div className="text-sm font-medium mb-2">
+                Selected {selectedCount} user{selectedCount !== 1 ? "s" : ""}:
+              </div>
+              <div className="flex flex-wrap gap-2">
+                {Object.entries(selectedUsers).map(([userId, role]) => {
+                  const user = orgUsers.find((u) => u.id === userId);
+                  return (
+                    <div key={userId} className="flex items-center gap-2 bg-background rounded px-2 py-1 text-sm">
+                      <span>{user?.name}</span>
+                      {getRoleBadge(role)}
+                    </div>
+                  );
+                })}
+              </div>
+            </div>
+          )}
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose} disabled={isSubmitting}>
+            Cancel
+          </Button>
+          <Button onClick={handleSubmit} disabled={selectedCount === 0 || isSubmitting}>
+            {isSubmitting ? (
+              <>
+                <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+                Granting Access...
+              </>
+            ) : (
+              `Grant Access to ${selectedCount} User${selectedCount !== 1 ? "s" : ""}`
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/airborne_dashboard/components/invite-management.tsx b/airborne_dashboard/components/invite-management.tsx
new file mode 100644
index 00000000..931ffa41
--- /dev/null
+++ b/airborne_dashboard/components/invite-management.tsx
@@ -0,0 +1,452 @@
+"use client";
+
+import React, { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Badge } from "@/components/ui/badge";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import {
+  Pagination,
+  PaginationContent,
+  PaginationEllipsis,
+  PaginationItem,
+  PaginationLink,
+  PaginationNext,
+  PaginationPrevious,
+} from "@/components/ui/pagination";
+import {
+  Search,
+  Mail,
+  MoreVertical,
+  Trash2,
+  RefreshCw,
+  Clock,
+  CheckCircle,
+  XCircle,
+  UserPlus,
+  Users,
+} from "lucide-react";
+import { useDebouncedValue } from "@/hooks/useDebouncedValue";
+import { ListInvitesResponse } from "@/types/invitation";
+import { formatDistanceToNow, parseISO } from "date-fns";
+import { ApplicationAccessModal } from "./application-access-modal";
+import { OrganizationAccessModal } from "./organization-access-modal";
+
+// Types for the new modal data
+interface OrgUser {
+  id: string;
+  name: string;
+  email: string;
+  username: string;
+  roles?: string[];
+}
+
+interface Application {
+  id: string;
+  name: string;
+  description?: string;
+}
+
+export interface InviteManagementProps {
+  data: ListInvitesResponse | undefined;
+  onRevokeInvite: (inviteId: string) => Promise<void>;
+  onRefresh: () => void;
+  onSearchChange?: (search: string) => void;
+  onStatusFilterChange?: (status: string) => void;
+  onPageChange?: (page: number) => void;
+  searchTerm?: string;
+  statusFilter?: string;
+  isLoading?: boolean;
+
+  // New props for the modals
+  showInviteButtons?: boolean;
+  entityType?: "organization" | "application";
+
+  // For Organization Access Modal
+  organizationName?: string;
+  applications?: Application[];
+  onOrganizationInvite?: (invite: {
+    email: string;
+    orgRole: string;
+    applications: { name: string; level: string }[];
+  }) => Promise<void>;
+
+  // For Application Access Modal
+  applicationName?: string;
+  orgUsers?: OrgUser[];
+  availableRoles?: string[];
+  onApplicationInvite?: (invites: { userId: string; role: string }[]) => Promise<void>;
+
+  // Loading states
+  isLoadingOrgUsers?: boolean;
+  isLoadingApplications?: boolean;
+}
+
+const ROLE_COLORS = {
+  admin: "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
+  write: "bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200",
+  read: "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200",
+};
+
+const STATUS_CONFIG = {
+  pending: {
+    icon: Clock,
+    color: "bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-200",
+    label: "Pending",
+  },
+  accepted: {
+    icon: CheckCircle,
+    color: "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200",
+    label: "Accepted",
+  },
+  declined: {
+    icon: XCircle,
+    color: "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
+    label: "Declined",
+  },
+  expired: {
+    icon: XCircle,
+    color: "bg-gray-100 text-gray-800 dark:bg-gray-900 dark:text-gray-200",
+    label: "Expired",
+  },
+};
+
+export function InviteManagement({
+  data,
+  onRevokeInvite,
+  onRefresh,
+  onSearchChange,
+  onStatusFilterChange,
+  onPageChange,
+  searchTerm = "",
+  statusFilter = "all",
+  isLoading,
+  showInviteButtons = false,
+  entityType = "organization",
+  organizationName,
+  applications = [],
+  onOrganizationInvite,
+  applicationName,
+  orgUsers = [],
+  availableRoles,
+  onApplicationInvite,
+  isLoadingOrgUsers = false,
+  isLoadingApplications = false,
+}: InviteManagementProps) {
+  const [isRevoking, setIsRevoking] = useState<string | null>(null);
+  const [localSearchTerm, setLocalSearchTerm] = useState(searchTerm);
+
+  // Modal states
+  const [isOrgAccessModalOpen, setIsOrgAccessModalOpen] = useState(false);
+  const [isAppAccessModalOpen, setIsAppAccessModalOpen] = useState(false);
+
+  const invites = data?.invites || [];
+  const pagination = data?.pagination;
+
+  // Debounce the search term to avoid excessive API calls
+  const debouncedSearchTerm = useDebouncedValue(localSearchTerm, 300);
+
+  // Effect to call the parent callback when debounced value changes
+  React.useEffect(() => {
+    if (debouncedSearchTerm !== searchTerm) {
+      onSearchChange?.(debouncedSearchTerm);
+    }
+  }, [debouncedSearchTerm, onSearchChange, searchTerm]);
+
+  // Sync local state when prop changes (e.g., when resetting from parent)
+  React.useEffect(() => {
+    if (searchTerm !== localSearchTerm) {
+      setLocalSearchTerm(searchTerm);
+    }
+  }, [searchTerm]);
+
+  const handleRevokeInvite = async (inviteId: string) => {
+    setIsRevoking(inviteId);
+    try {
+      await onRevokeInvite(inviteId);
+    } finally {
+      setIsRevoking(null);
+    }
+  };
+
+  // Modal handlers
+  const handleOrganizationInvite = async (invite: {
+    email: string;
+    orgRole: string;
+    applications: { name: string; level: string }[];
+  }) => {
+    if (onOrganizationInvite) {
+      await onOrganizationInvite(invite);
+      onRefresh(); // Refresh the invites list
+    }
+  };
+
+  const handleApplicationInvite = async (invites: { userId: string; role: string }[]) => {
+    if (onApplicationInvite) {
+      await onApplicationInvite(invites);
+      onRefresh(); // Refresh the invites list
+    }
+  };
+
+  const getStatusBadge = (status: string) => {
+    const config = STATUS_CONFIG[status as keyof typeof STATUS_CONFIG] || STATUS_CONFIG.pending;
+    const Icon = config.icon;
+
+    return (
+      <Badge className={config.color}>
+        <Icon className="h-3 w-3 mr-1" />
+        {config.label}
+      </Badge>
+    );
+  };
+
+  const getRoleBadge = (role: string) => {
+    const colorClass = ROLE_COLORS[role as keyof typeof ROLE_COLORS] || "bg-gray-100 text-gray-800";
+
+    return <Badge className={colorClass}>{role.charAt(0).toUpperCase() + role.slice(1)}</Badge>;
+  };
+
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex items-center justify-between">
+          <div>
+            <CardTitle className="flex items-center gap-2">
+              <Mail className="h-5 w-5" />
+              Invitations
+            </CardTitle>
+            <p className="text-sm text-muted-foreground mt-1">
+              {entityType === "organization"
+                ? "Manage organization invitations and their status"
+                : "Manage application invitations and their status"}
+            </p>
+          </div>
+          <div className="flex items-center gap-2">
+            {showInviteButtons && (
+              <>
+                {entityType === "organization" ? (
+                  <Button onClick={() => setIsOrgAccessModalOpen(true)} size="sm">
+                    <UserPlus className="h-4 w-4 mr-2" />
+                    Invite to Organization
+                  </Button>
+                ) : (
+                  <Button onClick={() => setIsAppAccessModalOpen(true)} size="sm">
+                    <Users className="h-4 w-4 mr-2" />
+                    Grant App Access
+                  </Button>
+                )}
+              </>
+            )}
+            <Button variant="outline" size="sm" onClick={onRefresh} disabled={isLoading}>
+              <RefreshCw className={`h-4 w-4 mr-2 ${isLoading ? "animate-spin" : ""}`} />
+              Refresh
+            </Button>
+          </div>
+        </div>
+      </CardHeader>
+
+      <CardContent className="space-y-4">
+        {/* Filters */}
+        <div className="flex flex-col sm:flex-row gap-4">
+          <div className="flex-1">
+            <div className="relative">
+              <Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+              <Input
+                placeholder="Search invitations..."
+                value={localSearchTerm}
+                onChange={(e) => setLocalSearchTerm(e.target.value)}
+                className="max-w-sm pl-10"
+              />
+            </div>
+          </div>
+
+          <Select value={statusFilter} onValueChange={onStatusFilterChange}>
+            <SelectTrigger className="w-full sm:w-48">
+              <SelectValue placeholder="Filter by status" />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="all">All Status</SelectItem>
+              <SelectItem value="pending">Pending</SelectItem>
+              <SelectItem value="accepted">Accepted</SelectItem>
+              <SelectItem value="declined">Declined</SelectItem>
+              <SelectItem value="expired">Expired</SelectItem>
+            </SelectContent>
+          </Select>
+        </div>
+
+        {/* Invitations Table */}
+        <div className="border rounded-lg">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Email</TableHead>
+                <TableHead>Role</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead>Invited</TableHead>
+                <TableHead className="w-[50px]">Actions</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {invites.length === 0 ? (
+                <TableRow>
+                  <TableCell colSpan={5} className="text-center py-8 text-muted-foreground">
+                    {debouncedSearchTerm || statusFilter !== "all"
+                      ? "No invitations match the current filters."
+                      : "No invitations found."}
+                  </TableCell>
+                </TableRow>
+              ) : (
+                invites.map((invite) => (
+                  <TableRow key={invite.id}>
+                    <TableCell className="font-mono text-sm">{invite.email}</TableCell>
+                    <TableCell>{getRoleBadge(invite.role)}</TableCell>
+                    <TableCell>{getStatusBadge(invite.status)}</TableCell>
+                    <TableCell className="text-sm text-muted-foreground">
+                      {formatDistanceToNow(parseISO(invite.created_at), { addSuffix: true })}
+                    </TableCell>
+                    <TableCell>
+                      {invite.status === "pending" && (
+                        <DropdownMenu>
+                          <DropdownMenuTrigger asChild>
+                            <Button
+                              variant="ghost"
+                              size="sm"
+                              className="h-8 w-8 p-0"
+                              disabled={isRevoking === invite.id}
+                            >
+                              <MoreVertical className="h-4 w-4" />
+                            </Button>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent align="end">
+                            <DropdownMenuItem
+                              onClick={() => handleRevokeInvite(invite.id)}
+                              className="text-destructive focus:text-destructive"
+                              disabled={isRevoking === invite.id}
+                            >
+                              {isRevoking === invite.id ? (
+                                <RefreshCw className="h-4 w-4 mr-2 animate-spin" />
+                              ) : (
+                                <Trash2 className="h-4 w-4 mr-2" />
+                              )}
+                              Revoke Invitation
+                            </DropdownMenuItem>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      )}
+                    </TableCell>
+                  </TableRow>
+                ))
+              )}
+            </TableBody>
+          </Table>
+        </div>
+
+        {/* Summary and Pagination */}
+        <div className="pt-4 border-t space-y-4">
+          <div className="flex items-center justify-between">
+            <div className="text-sm text-muted-foreground">
+              {pagination ? (
+                pagination.total_items > 0 ? (
+                  <>
+                    Showing {(pagination.current_page - 1) * pagination.per_page + 1}-
+                    {Math.min(pagination.current_page * pagination.per_page, pagination.total_items)} of{" "}
+                    {pagination.total_items} invitations
+                  </>
+                ) : (
+                  <>No invitations</>
+                )
+              ) : (
+                <>Showing {invites.length} invitations</>
+              )}
+            </div>
+            <div className="flex items-center gap-2">
+              <Button onClick={onRefresh} variant="outline" size="sm">
+                <RefreshCw className="h-4 w-4 mr-2" />
+                Refresh
+              </Button>
+            </div>
+          </div>
+
+          {pagination && pagination.total_pages > 1 && (
+            <div className="flex justify-center">
+              <Pagination>
+                <PaginationContent>
+                  <PaginationItem>
+                    <PaginationPrevious
+                      onClick={() => onPageChange?.(Math.max(1, pagination.current_page - 1))}
+                      className={pagination.current_page <= 1 ? "pointer-events-none opacity-50" : "cursor-pointer"}
+                    />
+                  </PaginationItem>
+                  {Array.from({ length: pagination.total_pages }, (_, i) => i + 1)
+                    .filter((page) => {
+                      const current = pagination.current_page;
+                      return (
+                        page === 1 || page === pagination.total_pages || (page >= current - 1 && page <= current + 1)
+                      );
+                    })
+                    .map((page, index, pages) => (
+                      <React.Fragment key={page}>
+                        {index > 0 && pages[index - 1] < page - 1 && (
+                          <PaginationItem key={`ellipsis-${page}`}>
+                            <PaginationEllipsis />
+                          </PaginationItem>
+                        )}
+                        <PaginationItem>
+                          <PaginationLink
+                            onClick={() => onPageChange?.(page)}
+                            isActive={page === pagination.current_page}
+                            className="cursor-pointer"
+                          >
+                            {page}
+                          </PaginationLink>
+                        </PaginationItem>
+                      </React.Fragment>
+                    ))}
+                  <PaginationItem>
+                    <PaginationNext
+                      onClick={() => onPageChange?.(Math.min(pagination.total_pages, pagination.current_page + 1))}
+                      className={
+                        pagination.current_page >= pagination.total_pages
+                          ? "pointer-events-none opacity-50"
+                          : "cursor-pointer"
+                      }
+                    />
+                  </PaginationItem>
+                </PaginationContent>
+              </Pagination>
+            </div>
+          )}
+        </div>
+      </CardContent>
+
+      {/* Organization Access Modal */}
+      <OrganizationAccessModal
+        isOpen={isOrgAccessModalOpen}
+        onClose={() => setIsOrgAccessModalOpen(false)}
+        onSubmit={handleOrganizationInvite}
+        applications={applications}
+        organizationName={organizationName || ""}
+        isLoading={isLoadingApplications}
+      />
+
+      {/* Application Access Modal */}
+      <ApplicationAccessModal
+        isOpen={isAppAccessModalOpen}
+        onClose={() => setIsAppAccessModalOpen(false)}
+        onSubmit={handleApplicationInvite}
+        orgUsers={orgUsers}
+        applicationName={applicationName || ""}
+        availableRoles={availableRoles}
+        isLoading={isLoadingOrgUsers}
+      />
+    </Card>
+  );
+}
diff --git a/airborne_dashboard/components/organization-access-modal.tsx b/airborne_dashboard/components/organization-access-modal.tsx
new file mode 100644
index 00000000..63efe1eb
--- /dev/null
+++ b/airborne_dashboard/components/organization-access-modal.tsx
@@ -0,0 +1,344 @@
+"use client";
+
+import React, { useState, useEffect } from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Badge } from "@/components/ui/badge";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { Mail, Building2, Loader2, CheckCircle2 } from "lucide-react";
+import { useAppContext } from "@/providers/app-context";
+
+interface Application {
+  id: string;
+  name: string;
+  description?: string;
+}
+
+interface ApplicationAccess {
+  name: string;
+  level: string;
+}
+
+interface OrganizationAccessInvite {
+  email: string;
+  orgRole: string;
+  applications: ApplicationAccess[];
+}
+
+export interface OrganizationAccessModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onSubmit: (invite: OrganizationAccessInvite) => Promise<void>;
+  applications: Application[];
+  organizationName: string;
+  isLoading?: boolean;
+}
+
+export function OrganizationAccessModal({
+  isOpen,
+  onClose,
+  onSubmit,
+  applications,
+  organizationName,
+  isLoading = false,
+}: OrganizationAccessModalProps) {
+  const { config } = useAppContext();
+  const [email, setEmail] = useState("");
+  const [selectedApplications, setSelectedApplications] = useState<Set<string>>(new Set());
+  const [applicationRoles, setApplicationRoles] = useState<Record<string, string>>({});
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [emailError, setEmailError] = useState("");
+
+  // Reset state when modal opens/closes
+  useEffect(() => {
+    if (!isOpen) {
+      setEmail("");
+      setSelectedApplications(new Set());
+      setApplicationRoles({});
+      setEmailError("");
+    }
+  }, [isOpen]);
+
+  // Email validation
+  const validateEmail = (email: string) => {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (!email) {
+      return "Email is required";
+    }
+    if (!emailRegex.test(email)) {
+      return "Please enter a valid email address";
+    }
+    return "";
+  };
+
+  const handleEmailChange = (value: string) => {
+    setEmail(value);
+    const error = validateEmail(value);
+    setEmailError(error);
+  };
+
+  const handleApplicationToggle = (applicationId: string, checked: boolean) => {
+    const newSelected = new Set(selectedApplications);
+    const newRoles = { ...applicationRoles };
+
+    if (checked) {
+      newSelected.add(applicationId);
+      newRoles[applicationId] = "read"; // Default role
+    } else {
+      newSelected.delete(applicationId);
+      delete newRoles[applicationId];
+    }
+
+    setSelectedApplications(newSelected);
+    setApplicationRoles(newRoles);
+  };
+
+  const handleRoleChange = (applicationId: string, role: string) => {
+    setApplicationRoles((prev) => ({ ...prev, [applicationId]: role }));
+  };
+
+  const handleSelectAllApps = (checked: boolean) => {
+    if (checked) {
+      const allAppIds = applications.map((app) => app.id);
+      setSelectedApplications(new Set(allAppIds));
+
+      // Set default role for all applications
+      const defaultRoles: Record<string, string> = {};
+      allAppIds.forEach((appId) => {
+        defaultRoles[appId] = "read";
+      });
+      setApplicationRoles(defaultRoles);
+    } else {
+      setSelectedApplications(new Set());
+      setApplicationRoles({});
+    }
+  };
+
+  const handleSubmit = async () => {
+    const emailValidationError = validateEmail(email);
+    if (emailValidationError) {
+      setEmailError(emailValidationError);
+      return;
+    }
+
+    const invite: OrganizationAccessInvite = {
+      email: email.trim(),
+      orgRole: "read", // Fixed to read as per requirements
+      applications: Array.from(selectedApplications).map((appId) => {
+        const app = applications.find((a) => a.id === appId);
+        return {
+          name: app?.name || appId,
+          level: applicationRoles[appId] || "read",
+        };
+      }),
+    };
+
+    setIsSubmitting(true);
+    try {
+      await onSubmit(invite);
+      onClose();
+    } catch (e: any) {
+      console.error(`Error sending ${config?.organisation_invite_enabled ? "invite" : "add"}:`, e);
+      setEmailError(
+        e?.message || `An error occurred while sending the ${config?.organisation_invite_enabled ? "invite" : "add"}.`
+      );
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const selectedCount = selectedApplications.size;
+  const isAllSelected = applications.length > 0 && applications.every((app) => selectedApplications.has(app.id));
+  const canSubmit = email && !emailError && !isSubmitting;
+
+  return (
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="max-w-2xl max-h-[80vh] overflow-hidden flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Building2 className="h-5 w-5" />
+            {config?.organisation_invite_enabled ? "Invite" : "Add"} User to Organization
+          </DialogTitle>
+          <DialogDescription>
+            {config?.organisation_invite_enabled ? "Invite" : "Add"} a new user to <strong>{organizationName}</strong>{" "}
+            with read-only organization access. Select which applications they should have access to. You can change
+            access levels later.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="flex-1 overflow-hidden flex flex-col gap-6">
+          {/* Email Input */}
+          <div className="space-y-2">
+            <Label htmlFor="email">Email Address</Label>
+            <div className="relative">
+              <Mail className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+              <Input
+                id="email"
+                type="email"
+                placeholder="user@example.com"
+                value={email}
+                onChange={(e) => handleEmailChange(e.target.value)}
+                className={`pl-9 ${emailError ? "border-red-500" : ""}`}
+                disabled={isSubmitting}
+              />
+            </div>
+            {emailError && <p className="text-sm text-red-500">{emailError}</p>}
+          </div>
+
+          {/* Organization Role Info */}
+          <div className="p-4 bg-muted rounded-lg">
+            <div className="flex items-center justify-between">
+              <div>
+                <h4 className="text-sm font-medium">Organization Role</h4>
+                <p className="text-sm text-muted-foreground">
+                  The user will be granted read-only access to the organization
+                </p>
+              </div>
+              <Badge className="bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200">Read</Badge>
+            </div>
+          </div>
+
+          {/* Application Selection */}
+          <div className="space-y-3">
+            <div className="flex items-center justify-between">
+              <Label className="text-sm font-medium">Application Access</Label>
+              <div className="flex items-center space-x-2">
+                <Checkbox id="select-all-apps" checked={isAllSelected} onCheckedChange={handleSelectAllApps} />
+                <Label htmlFor="select-all-apps" className="text-sm font-medium">
+                  Select All ({applications.length})
+                </Label>
+              </div>
+            </div>
+
+            {/* Applications List */}
+            <div className="flex-1 overflow-auto border rounded-lg max-h-60">
+              {isLoading ? (
+                <div className="p-8 text-center">
+                  <div className="flex items-center justify-center gap-2">
+                    <Loader2 className="h-4 w-4 animate-spin" />
+                    Loading applications...
+                  </div>
+                </div>
+              ) : applications.length === 0 ? (
+                <div className="p-8 text-center text-muted-foreground">
+                  No applications available in this organization.
+                </div>
+              ) : (
+                <Table>
+                  <TableHeader>
+                    <TableRow>
+                      <TableHead className="w-12">Select</TableHead>
+                      <TableHead>Application</TableHead>
+                      <TableHead>Description</TableHead>
+                      <TableHead className="w-32">Role</TableHead>
+                    </TableRow>
+                  </TableHeader>
+                  <TableBody>
+                    {applications.map((app) => {
+                      const isSelected = selectedApplications.has(app.id);
+
+                      return (
+                        <TableRow key={app.id}>
+                          <TableCell>
+                            <Checkbox
+                              checked={isSelected}
+                              onCheckedChange={(checked) => handleApplicationToggle(app.id, checked as boolean)}
+                            />
+                          </TableCell>
+                          <TableCell>
+                            <div className="flex items-center gap-2">
+                              <div className="font-medium">{app.name}</div>
+                              {isSelected && <CheckCircle2 className="h-4 w-4 text-green-600" />}
+                            </div>
+                          </TableCell>
+                          <TableCell className="text-sm text-muted-foreground">
+                            {app.description || "No description available"}
+                          </TableCell>
+                          <TableCell>
+                            {isSelected ? (
+                              <Select
+                                value={applicationRoles[app.id] || "read"}
+                                onValueChange={(value) => handleRoleChange(app.id, value)}
+                              >
+                                <SelectTrigger className="w-28">
+                                  <SelectValue />
+                                </SelectTrigger>
+                                <SelectContent>
+                                  <SelectItem value="read">Read</SelectItem>
+                                  <SelectItem value="write">Write</SelectItem>
+                                  <SelectItem value="admin">Admin</SelectItem>
+                                </SelectContent>
+                              </Select>
+                            ) : (
+                              <span className="text-sm text-muted-foreground">-</span>
+                            )}
+                          </TableCell>
+                        </TableRow>
+                      );
+                    })}
+                  </TableBody>
+                </Table>
+              )}
+            </div>
+
+            {/* Selected Applications Summary */}
+            {selectedCount > 0 && (
+              <div className="p-3 bg-muted rounded-lg">
+                <div className="text-sm font-medium mb-2">
+                  Selected {selectedCount} application{selectedCount !== 1 ? "s" : ""}:
+                </div>
+                <div className="flex flex-wrap gap-2">
+                  {Array.from(selectedApplications).map((appId) => {
+                    const app = applications.find((a) => a.id === appId);
+                    const role = applicationRoles[appId] || "read";
+                    return (
+                      <div
+                        key={appId}
+                        className="flex items-center gap-1 bg-background rounded px-2 py-1 text-sm border"
+                      >
+                        <span className="font-medium">{app?.name}</span>
+                        <span className="text-muted-foreground">-</span>
+                        <Badge variant="secondary" className="text-xs px-1 py-0 h-4">
+                          {role}
+                        </Badge>
+                      </div>
+                    );
+                  })}
+                </div>
+              </div>
+            )}
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose} disabled={isSubmitting}>
+            Cancel
+          </Button>
+          <Button onClick={handleSubmit} disabled={!canSubmit}>
+            {isSubmitting ? (
+              <>
+                <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+                {config?.organisation_invite_enabled ? "Sending Invite..." : "Adding User..."}
+              </>
+            ) : config?.organisation_invite_enabled ? (
+              "Send Invite"
+            ) : (
+              "Add User"
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/airborne_dashboard/components/user-management.tsx b/airborne_dashboard/components/user-management.tsx
index ee9229e3..f8f66de0 100644
--- a/airborne_dashboard/components/user-management.tsx
+++ b/airborne_dashboard/components/user-management.tsx
@@ -14,6 +14,7 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { Search, UserPlus, MoreVertical, Trash2, ArrowRight, Crown } from "lucide-react";
 import { useDebouncedValue } from "@/hooks/useDebouncedValue";
+import { toastSuccess, toastError } from "@/hooks/use-toast";
 
 export type AccessLevel = "owner" | "admin" | "write" | "read";
 
@@ -30,9 +31,11 @@ export interface UserManagementProps {
   onUpdateUser: (user: string, access: AccessLevel) => Promise<void>;
   onRemoveUser: (user: string) => Promise<void>;
   onTransferOwnership?: (user: string) => Promise<void>;
+  onInviteCreated?: () => void; // Callback for when an invitation is created
   title?: string;
   description?: string;
   entityType?: "organisation" | "application";
+  hideAddUserButton?: boolean; // New prop to hide the add user button
 }
 
 const ACCESS_LEVELS: { value: AccessLevel; label: string; color: string }[] = [
@@ -57,7 +60,7 @@ const getAccessLevelRoles = (level: AccessLevel): AccessLevel[] => {
   }
 };
 
-const canUpdateUsers = (
+export const canUpdateUsers = (
   entityType: "organisation" | "application",
   orgAccess: string[],
   appAccess?: string[]
@@ -86,9 +89,11 @@ export function UserManagement({
   onUpdateUser,
   onRemoveUser,
   onTransferOwnership,
+  onInviteCreated,
   title = "User Management",
   description = "Manage users and their access levels",
   entityType = "organisation",
+  hideAddUserButton = false,
 }: UserManagementProps) {
   const [search, setSearch] = React.useState("");
   const debouncedSearch = useDebouncedValue(search, 500);
@@ -99,6 +104,7 @@ export function UserManagement({
   const [userToRemove, setUserToRemove] = React.useState<string | null>(null);
   const [isTransferDialogOpen, setIsTransferDialogOpen] = React.useState(false);
   const [userToTransfer, setUserToTransfer] = React.useState<string | null>(null);
+  const [isInviting, setIsInviting] = React.useState(false);
 
   const canUpdate = canUpdateUsers(entityType, currentUserOrgAccess, currentUserAppAccess);
   const filteredUsers = useMemo(() => {
@@ -108,13 +114,25 @@ export function UserManagement({
   const handleAddUser = async () => {
     if (!newUser.trim()) return;
 
+    setIsInviting(true);
     try {
       await onAddUser(newUser.trim(), newUserAccess);
       setNewUser("");
       setNewUserAccess("read");
       setIsAddDialogOpen(false);
-    } catch (error) {
+
+      // Show success toast
+      toastSuccess("Invitation Sent", `Successfully sent invitation to ${newUser.trim()} with ${newUserAccess} access`);
+
+      // Notify parent component that an invitation was created
+      onInviteCreated?.();
+    } catch (error: any) {
       console.error("Failed to add user:", error);
+
+      // Show error toast
+      toastError("Failed to Send Invitation", error?.message || "Could not send invitation. Please try again.");
+    } finally {
+      setIsInviting(false);
     }
   };
 
@@ -181,7 +199,7 @@ export function UserManagement({
               <CardTitle>{title}</CardTitle>
               <p className="text-sm text-muted-foreground mt-1">{description}</p>
             </div>
-            {canUpdate && (
+            {canUpdate && !hideAddUserButton && (
               <Dialog open={isAddDialogOpen} onOpenChange={setIsAddDialogOpen}>
                 <DialogTrigger asChild>
                   <Button>
@@ -191,16 +209,12 @@ export function UserManagement({
                 </DialogTrigger>
                 <DialogContent>
                   <DialogHeader>
-                    <DialogTitle>Add New User</DialogTitle>
+                    <DialogTitle>Invite user to Organisation</DialogTitle>
                   </DialogHeader>
                   <div className="space-y-4">
                     <div>
-                      <label className="text-sm font-medium">Username</label>
-                      <Input
-                        placeholder="Enter username"
-                        value={newUser}
-                        onChange={(e) => setNewUser(e.target.value)}
-                      />
+                      <label className="text-sm font-medium">Email</label>
+                      <Input placeholder="Enter email" value={newUser} onChange={(e) => setNewUser(e.target.value)} />
                     </div>
                     <div>
                       <label className="text-sm font-medium">Access Level</label>
@@ -227,11 +241,11 @@ export function UserManagement({
                       </Select>
                     </div>
                     <div className="flex justify-end gap-2">
-                      <Button variant="outline" onClick={() => setIsAddDialogOpen(false)}>
+                      <Button variant="outline" onClick={() => setIsAddDialogOpen(false)} disabled={isInviting}>
                         Cancel
                       </Button>
-                      <Button onClick={handleAddUser} disabled={!newUser.trim()}>
-                        Add User
+                      <Button onClick={handleAddUser} disabled={!newUser.trim() || isInviting}>
+                        {isInviting ? "Sending..." : "Invite"}
                       </Button>
                     </div>
                   </div>
diff --git a/airborne_dashboard/lib/invitation.ts b/airborne_dashboard/lib/invitation.ts
new file mode 100644
index 00000000..235d5484
--- /dev/null
+++ b/airborne_dashboard/lib/invitation.ts
@@ -0,0 +1,156 @@
+import {
+  AcceptInviteResponse,
+  DeclineInviteResponse,
+  InviteDetails,
+  ListInvitesResponse,
+  ValidateInviteResponse,
+} from "@/types/invitation";
+import { apiFetch } from "./api";
+
+export async function validateInviteToken(token: string, _authToken?: string): Promise<InviteDetails> {
+  try {
+    const response = await apiFetch<ValidateInviteResponse>("/organisation/user/invite/validate", {
+      method: "POST",
+      body: { token },
+      requireAuth: false, // Allow validation without authentication
+      showErrorToast: false, // We'll handle errors manually
+    });
+
+    if (!response.valid) {
+      throw new Error("Invalid invite token");
+    }
+
+    // Convert backend response to InviteDetails format
+    return {
+      invite_id: response.invite_id,
+      email: response.email,
+      organization: response.organization,
+      role: response.role,
+      status: response.status,
+      created_at: response.created_at,
+      inviter: response.inviter,
+    };
+  } catch (error: any) {
+    // Handle specific error cases
+    if (error.message?.includes("Invalid or expired")) {
+      throw new Error("Invite token has expired or is invalid");
+    }
+
+    if (error.status === 404) {
+      throw new Error("Invalid invite token");
+    }
+
+    // Re-throw other errors
+    throw error;
+  }
+}
+
+export async function acceptInvite(inviteId: string, token: string, authToken: string): Promise<AcceptInviteResponse> {
+  return apiFetch<AcceptInviteResponse>(`/organisations/user/invite/${inviteId}/accept`, {
+    method: "POST",
+    body: { token },
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+    },
+  });
+}
+
+export async function declineInvite(
+  inviteId: string,
+  token: string,
+  authToken: string
+): Promise<DeclineInviteResponse> {
+  return apiFetch<DeclineInviteResponse>(`/organisations/user/invite/${inviteId}/decline`, {
+    method: "POST",
+    body: { token },
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+    },
+  });
+}
+
+export async function listInvites(
+  authToken: string,
+  orgId: string,
+  params?: {
+    search?: string;
+    status?: string;
+    page?: number;
+    per_page?: number;
+  }
+): Promise<ListInvitesResponse> {
+  return apiFetch<ListInvitesResponse>("/organisations/user/invite/list", {
+    method: "GET",
+    query: params,
+    showErrorToast: false,
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "x-organisation": orgId,
+    },
+  });
+}
+
+// Revoke an invitation
+export async function revokeInvite(
+  inviteId: string,
+  authToken: string,
+  orgId: string
+): Promise<{ success: boolean; message: string }> {
+  return apiFetch<{ success: boolean; message: string }>(`/organisations/user/invite/${inviteId}/revoke`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "x-organisation": orgId,
+    },
+  });
+}
+
+// Send organization invitation
+export async function sendOrganizationInvite(
+  invite: {
+    email: string;
+    orgRole: string;
+    applications: string[];
+  },
+  authToken: string,
+  orgId: string
+): Promise<{ success: boolean; message: string }> {
+  return apiFetch<{ success: boolean; message: string }>("/organisations/user/invite", {
+    method: "POST",
+    body: {
+      email: invite.email,
+      org_role: invite.orgRole,
+      applications: invite.applications,
+    },
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "x-organisation": orgId,
+    },
+  });
+}
+
+// Send application access invitations
+export async function sendApplicationInvites(
+  invites: Array<{
+    userId: string;
+    role: string;
+  }>,
+  authToken: string,
+  orgId: string,
+  appId: string
+): Promise<{ success: boolean; message: string; invited_count: number }> {
+  return apiFetch<{ success: boolean; message: string; invited_count: number }>("/applications/user/invite/grant", {
+    method: "POST",
+    body: {
+      user_invites: invites.map((invite) => ({
+        user_id: invite.userId,
+        role: invite.role,
+      })),
+    },
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "x-organisation": orgId,
+      "x-application": appId,
+    },
+  });
+}
diff --git a/airborne_dashboard/next.config.mjs b/airborne_dashboard/next.config.mjs
index 891adbfe..3bc9f482 100644
--- a/airborne_dashboard/next.config.mjs
+++ b/airborne_dashboard/next.config.mjs
@@ -14,7 +14,8 @@ const nextConfig = {
         destination: `https://airborne.juspay.in/analytics/:path*`,
       },
       {
-        source: "/api/:api(releases|file|organisations|applications|users|packages|dashboard|token)/:path*",
+        source:
+          "/api/:api(releases|file|organisations|applications|users|packages|dashboard|token|organisation)/:path*",
         destination: `${backend}/api/:api/:path*`,
       },
       {
diff --git a/airborne_dashboard/providers/app-context.tsx b/airborne_dashboard/providers/app-context.tsx
index 47991280..fe28e593 100644
--- a/airborne_dashboard/providers/app-context.tsx
+++ b/airborne_dashboard/providers/app-context.tsx
@@ -38,6 +38,7 @@ type AppContextType = {
 interface Configuration {
   google_signin_enabled: boolean;
   organisation_creation_disabled: boolean;
+  organisation_invite_enabled: boolean;
 }
 
 const AppContext = createContext<AppContextType | undefined>(undefined);
diff --git a/airborne_dashboard/types/invitation.ts b/airborne_dashboard/types/invitation.ts
new file mode 100644
index 00000000..1cf825ac
--- /dev/null
+++ b/airborne_dashboard/types/invitation.ts
@@ -0,0 +1,76 @@
+export interface InviteDetails {
+  invite_id: string;
+  email: string;
+  organization: string;
+  role: string;
+  status: string;
+  created_at: string;
+  inviter?: string;
+}
+
+export interface ValidateInviteResponse {
+  invite_id: string;
+  valid: boolean;
+  email: string;
+  organization: string;
+  role: string;
+  status: string;
+  created_at: string;
+  inviter?: string;
+}
+
+export interface AcceptInviteResponse {
+  success: boolean;
+  message: string;
+  organization: string;
+  role: string;
+  action: "Accepted" | "Declined";
+}
+
+export interface DeclineInviteResponse {
+  success: boolean;
+  message: string;
+  organization: string;
+  role: string;
+  action: "Accepted" | "Declined";
+}
+
+// List invitations for an organization
+export interface ListInvitesResponse {
+  invites: InviteListItem[];
+  pagination: {
+    current_page: number;
+    per_page: number;
+    total_items: number;
+    total_pages: number;
+  };
+}
+
+export interface InviteListItem {
+  id: string;
+  email: string;
+  role: string;
+  status: string;
+  created_at: string;
+}
+
+// New types for the enhanced invitation system
+export interface OrganizationInviteRequest {
+  email: string;
+  orgRole: string;
+  applications: string[];
+}
+
+export interface ApplicationInviteRequest {
+  userId: string;
+  role: string;
+}
+
+export interface InviteResponse {
+  success: boolean;
+  message: string;
+}
+
+export interface ApplicationInviteResponse extends InviteResponse {
+  invited_count: number;
+}
diff --git a/airborne_server/.env.example b/airborne_server/.env.example
index 2d0c1597..091f43be 100644
--- a/airborne_server/.env.example
+++ b/airborne_server/.env.example
@@ -44,3 +44,10 @@ RUST_LOG=debug,info,error,actix_web=info,error
 LOG_FORMAT=
 SUPERPOSITION_MIGRATION_STRATEGY=PATCH
 MIGRATIONS_TO_RUN_ON_BOOT=db,superposition
+
+ENABLE_ORGANISATION_INVITE=false # Set to true to enable organisation invite flow (Requires SMTP setup)
+MOCK_EMAIL_SENDING=true # Use Mailcatcher for local email testing (must be turned off in production)
+SMTP_HOST=localhost
+SMTP_PORT=587
+SMTP_USER=admin
+SMTP_PASSWORD=admin
diff --git a/airborne_server/Cargo.toml b/airborne_server/Cargo.toml
index 3af42378..c45e72d8 100644
--- a/airborne_server/Cargo.toml
+++ b/airborne_server/Cargo.toml
@@ -34,14 +34,17 @@ http = "0.2.12"
 http-body = "1.0.1"
 jsonwebtoken = "9.3.1"
 keycloak = "=26.1.0"
+lettre = { version = "=0.11.19", features = ["builder", "smtp-transport", "native-tls"] }
 log = "0.4.27"
 r2d2 = "=0.8.10"
+rand = "0.8"
 reqwest = { version = "^0.12.5", features = ["blocking", "stream"] }
 rustls = { version = "0.23.5" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = "0.10"
 superposition_sdk = "0.91.1"
+tera = "=1.20.1"
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
diff --git a/airborne_server/localhost:5433 b/airborne_server/localhost:5433
new file mode 100644
index 00000000..2f5155f4
Binary files /dev/null and b/airborne_server/localhost:5433 differ
diff --git a/airborne_server/migrations/20251030123645_create_org_invites_table/down.sql b/airborne_server/migrations/20251030123645_create_org_invites_table/down.sql
new file mode 100644
index 00000000..23cb3b3a
--- /dev/null
+++ b/airborne_server/migrations/20251030123645_create_org_invites_table/down.sql
@@ -0,0 +1,5 @@
+-- This file should undo anything in `up.sql`
+DROP TABLE IF EXISTS hyperotaserver.organisation_invites CASCADE;
+DROP TYPE IF EXISTS hyperotaserver.invite_status CASCADE;
+DROP TYPE IF EXISTS hyperotaserver.invite_role CASCADE;
+DROP INDEX IF EXISTS organisation_invites_org_id_idx;
\ No newline at end of file
diff --git a/airborne_server/migrations/20251030123645_create_org_invites_table/up.sql b/airborne_server/migrations/20251030123645_create_org_invites_table/up.sql
new file mode 100644
index 00000000..1b134b90
--- /dev/null
+++ b/airborne_server/migrations/20251030123645_create_org_invites_table/up.sql
@@ -0,0 +1,17 @@
+CREATE TYPE IF NOT EXISTS hyperotaserver.invite_status AS ENUM ('pending', 'accepted', 'declined', 'expired');
+CREATE TYPE IF NOT EXISTS hyperotaserver.invite_role AS ENUM ('admin', 'read', 'write');
+
+CREATE TABLE IF NOT EXISTS hyperotaserver.organisation_invites (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    org_id TEXT NOT NULL,
+    applications JSONB NOT NULL DEFAULT '[]'::jsonb,
+    email TEXT NOT NULL,
+    role hyperotaserver.invite_role NOT NULL,
+    token TEXT NOT NULL,
+    status hyperotaserver.invite_status NOT NULL DEFAULT 'pending',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS organisation_invites_org_id_idx ON hyperotaserver.organisation_invites (org_id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS organisation_invites_token_idx ON hyperotaserver.organisation_invites (token);
diff --git a/airborne_server/src/dashboard/configuration.rs b/airborne_server/src/dashboard/configuration.rs
index 038ba788..db1df000 100644
--- a/airborne_server/src/dashboard/configuration.rs
+++ b/airborne_server/src/dashboard/configuration.rs
@@ -29,6 +29,7 @@ pub fn add_routes() -> Scope {
 struct Configuration {
     google_signin_enabled: bool,
     organisation_creation_disabled: bool,
+    organisation_invite_enabled: bool,
 }
 
 #[get("")]
@@ -39,6 +40,7 @@ async fn get_global_configurations(
     let config = Configuration {
         google_signin_enabled: state.env.enable_google_signin,
         organisation_creation_disabled: state.env.organisation_creation_disabled,
+        organisation_invite_enabled: state.env.enable_organisation_invite,
     };
 
     Ok(Json(config))
diff --git a/airborne_server/src/main.rs b/airborne_server/src/main.rs
index 000c9e0d..6278945e 100644
--- a/airborne_server/src/main.rs
+++ b/airborne_server/src/main.rs
@@ -38,6 +38,7 @@ use google_sheets4::{
     yup_oauth2::{self, ServiceAccountAuthenticator},
     Sheets,
 };
+use lettre::{transport::smtp::authentication::Credentials, SmtpTransport};
 use log::info;
 use serde_json::json;
 use std::{
@@ -45,6 +46,7 @@ use std::{
     sync::Arc,
 };
 use superposition_sdk::config::Config as SrsConfig;
+use tera::Tera;
 use tracing_actix_web::TracingLogger;
 use utils::{db, kms::decrypt_kms, transaction_manager::start_cleanup_job};
 
@@ -131,6 +133,16 @@ async fn main() -> std::io::Result<()> {
         .map(|s| s.trim().into())
         .collect();
 
+    let enable_organisation_invite = std::env::var("ENABLE_ORGANISATION_INVITE")
+        .ok()
+        .and_then(|v| v.parse::<bool>().ok())
+        .unwrap_or_default();
+
+    let mock_email_sending = std::env::var("MOCK_EMAIL_SENDING")
+        .ok()
+        .and_then(|v| v.parse::<bool>().ok())
+        .unwrap_or_default();
+
     //Need to check if this ENV exists on pod
     let uses_local_stack = std::env::var("AWS_ENDPOINT_URL");
     let mut force_path_style = false;
@@ -169,6 +181,40 @@ async fn main() -> std::io::Result<()> {
         None
     };
 
+    let mailer = if mock_email_sending && enable_organisation_invite {
+        // Local testing with Mailcatcher / Mailhog
+        Some(
+            SmtpTransport::builder_dangerous("127.0.0.1")
+                .port(1025)
+                .build(),
+        )
+    } else if enable_organisation_invite {
+        let smtp_host = std::env::var("SMTP_HOST").expect("SMTP_HOST must be set");
+        let smtp_user = std::env::var("SMTP_USER").expect("SMTP_USER must be set");
+        let smtp_password = std::env::var("SMTP_PASSWORD").expect("SMTP_PASSWORD must be set");
+
+        let creds = Credentials::new(smtp_user, smtp_password);
+
+        // STARTTLS for port 587 (submission)
+        Some(
+            SmtpTransport::starttls_relay(&smtp_host)
+                .expect("Failed to connect to SMTP server")
+                .credentials(creds)
+                .build(),
+        )
+    } else {
+        None
+    };
+
+    let tera = if enable_organisation_invite {
+        Some(Tera::new("templates/**/*").map_err(|e| {
+            println!("Parsing error(s): {}", e);
+            std::io::Error::other("Template parsing error")
+        })?)
+    } else {
+        None
+    };
+
     // Initialize DB pool
     info!("Creating db pool");
     let pool = db::establish_pool(&aws_kms_client).await;
@@ -199,6 +245,7 @@ async fn main() -> std::io::Result<()> {
         default_configs: get_default_configs_from_file()
             .await
             .expect("Failed to load superposition default configs from file"),
+        enable_organisation_invite,
     };
 
     // This is required for localStack
@@ -250,6 +297,8 @@ async fn main() -> std::io::Result<()> {
         cf_client: aws_cloudfront_client,
         superposition_client,
         sheets_hub: hub,
+        mailer: mailer.map(Arc::new),
+        tera: tera.map(Arc::new),
     });
 
     // Start the background cleanup job for transaction reconciliation
@@ -303,6 +352,10 @@ async fn main() -> std::io::Result<()> {
                     .service(
                         web::scope("/dashboard/configuration").service(configuration::add_routes()),
                     )
+                    .service(
+                        web::scope("/organisation/user/invite")
+                            .service(organisation::user::invite::add_public_routes()),
+                    )
                     .service(
                         web::scope("/organisations")
                             .wrap(Auth)
diff --git a/airborne_server/src/organisation/application/user.rs b/airborne_server/src/organisation/application/user.rs
index 107e9017..a0ed8738 100644
--- a/airborne_server/src/organisation/application/user.rs
+++ b/airborne_server/src/organisation/application/user.rs
@@ -27,20 +27,23 @@ use crate::{
     middleware::auth::{
         validate_required_access, validate_user, Access, AuthResponse, ADMIN, READ,
     },
-    organisation::application::{types::OrgAppError, user::types::*},
-    types as airborne_types,
-    types::{ABError, AppState},
+    organisation::{
+        application::{types::OrgAppError, user::types::*},
+        user::types::UserContext,
+    },
+    types::{self as airborne_types, ABError, AppState},
     utils::keycloak::{find_org_group, find_user_by_username, prepare_user_action},
 };
 
 use self::{
     transaction::{
-        add_user_with_transaction, get_user_current_role, remove_user_with_transaction,
-        update_user_with_transaction,
+        get_user_current_role, remove_user_with_transaction, update_user_with_transaction,
     },
     utils::{check_role_hierarchy, is_last_admin_in_application, validate_access_level},
 };
 
+pub use crate::organisation::application::user::transaction::add_user_with_transaction;
+
 pub fn add_routes() -> Scope {
     Scope::new("")
         .service(application_list_users)
@@ -137,7 +140,7 @@ async fn find_target_user(
 }
 
 /// Find an application and extract its context
-async fn find_application(
+pub async fn find_application(
     admin: &keycloak::KeycloakAdmin,
     realm: &str,
     org_name: &str,
diff --git a/airborne_server/src/organisation/application/user/types.rs b/airborne_server/src/organisation/application/user/types.rs
index b8229633..a6425368 100644
--- a/airborne_server/src/organisation/application/user/types.rs
+++ b/airborne_server/src/organisation/application/user/types.rs
@@ -49,13 +49,6 @@ pub struct UserInfo {
     pub roles: Vec<String>,
 }
 
-// Helper structs
-
-pub struct UserContext {
-    pub user_id: String,
-    pub username: String,
-}
-
 pub struct AppContext {
     pub org_name: String,
     pub app_name: String,
diff --git a/airborne_server/src/organisation/user.rs b/airborne_server/src/organisation/user.rs
index 03a5e984..fa3b7acb 100644
--- a/airborne_server/src/organisation/user.rs
+++ b/airborne_server/src/organisation/user.rs
@@ -12,8 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+pub mod invite;
 mod transaction;
-mod types;
+pub mod types;
 mod utils;
 
 use actix_web::{
@@ -27,27 +28,30 @@ use crate::{
     middleware::auth::{
         validate_required_access, validate_user, Access, AuthResponse, ADMIN, OWNER, READ, WRITE,
     },
-    organisation::{types::OrgError, user::types::*},
-    types as airborne_types,
-    types::{ABError, AppState},
+    organisation::{
+        application::{self, user::find_application},
+        types::OrgError,
+        user::{transaction::add_user_with_transaction, types::*},
+    },
+    types::{self as airborne_types, ABError, AppState},
     utils::keycloak::{find_org_group, find_user_by_username, prepare_user_action},
 };
 
 use self::{
     transaction::{
-        add_user_with_transaction, get_user_current_role, remove_user_with_transaction,
-        update_user_with_transaction,
+        get_user_current_role, remove_user_with_transaction, update_user_with_transaction,
     },
     utils::{check_role_hierarchy, is_last_owner, validate_access_level},
 };
 
 pub fn add_routes() -> Scope {
     Scope::new("")
-        .service(organisation_list_users)
         .service(organisation_add_user)
+        .service(organisation_list_users)
         .service(organisation_update_user)
         .service(organisation_remove_user)
         .service(organisation_transfer_ownership)
+        .service(Scope::new("/invite").service(invite::add_routes()))
 }
 
 /// Get organization context and validate user permissions
@@ -150,6 +154,13 @@ async fn organisation_add_user(
     body: Json<UserRequest>,
     state: web::Data<AppState>,
 ) -> airborne_types::Result<Json<UserOperationResponse>> {
+    if state.env.enable_organisation_invite {
+        return Err(ABError::Forbidden(
+            "Organization invitations are enabled, kindly invite user to your organisation."
+                .to_string(),
+        ));
+    }
+
     let body = body.into_inner();
 
     // Get organization context and validate requester's permissions
@@ -210,10 +221,40 @@ async fn organisation_add_user(
         body.user, organisation, role_name
     );
 
+    for app_access in body.applications.unwrap_or_default() {
+        let app_context = find_application(&admin, &realm, &org_context.org_id, &app_access.name)
+            .await
+            .map_err(|e| {
+                ABError::NotFound(format!(
+                    "Failed to find application {}: {}",
+                    app_access.name, e
+                ))
+            })?;
+
+        application::user::add_user_with_transaction(
+            &admin,
+            &realm,
+            &app_context,
+            &target_user,
+            match app_access.level {
+                AccessLvl::Admin => "admin",
+                AccessLvl::Write => "write",
+                AccessLvl::Read => "read",
+            },
+        )
+        .await
+        .map_err(|e| {
+            ABError::InternalServerError(format!(
+                "Failed to add user to application {}: {}",
+                app_access.name, e
+            ))
+        })?;
+    }
+
     Ok(Json(UserOperationResponse {
         user: body.user,
         success: true,
-        operation: "add".to_string(),
+        operation: "add_user".to_string(),
     }))
 }
 
diff --git a/airborne_server/src/organisation/user/invite.rs b/airborne_server/src/organisation/user/invite.rs
new file mode 100644
index 00000000..2c308edf
--- /dev/null
+++ b/airborne_server/src/organisation/user/invite.rs
@@ -0,0 +1,821 @@
+use actix_web::{
+    get, post,
+    web::{self, Json, Path, Query},
+    HttpMessage, HttpRequest, Scope,
+};
+use chrono::Utc;
+use diesel::{
+    dsl::sql,
+    prelude::*,
+    sql_types::{Bool, Text},
+};
+use keycloak::KeycloakAdmin;
+use log::{debug, info};
+use uuid::Uuid;
+
+use crate::{
+    middleware::auth::{AuthResponse, ADMIN, WRITE},
+    organisation::{
+        application::{self, user::find_application},
+        types::OrgError,
+        user::{
+            find_organization, get_org_context,
+            invite::types::*,
+            transaction::add_user_with_transaction,
+            types::{UserOperationResponse, UserRequest},
+            utils::validate_access_level,
+            AccessLvl, ApplicationAccess, OrgContext, UserContext,
+        },
+    },
+    run_blocking,
+    types::{self as airborne_types, ABError, AppState},
+    utils::{
+        db::{
+            models::{InviteRole, InviteStatus, OrganisationInviteEntry},
+            schema::hyperotaserver::organisation_invites::{self},
+            DbPool,
+        },
+        keycloak::{find_org_group, find_user_by_username, prepare_user_action},
+        mail::Mail,
+    },
+};
+
+mod types;
+
+pub fn add_routes() -> Scope {
+    Scope::new("")
+        .service(send_invitation)
+        .service(accept_invite)
+        .service(decline_invite)
+        .service(list_invites)
+        .service(revoke_invite)
+}
+
+pub fn add_public_routes() -> Scope {
+    Scope::new("").service(validate_invite)
+}
+
+/// Check if there's an existing pending invite for the same org and email
+async fn find_existing_pending_invite(
+    pool: &DbPool,
+    org_id: &str,
+    email: &str,
+    role: &InviteRole,
+) -> airborne_types::Result<Option<OrganisationInviteEntry>> {
+    let pool = pool.clone();
+    let org_id = org_id.to_string();
+    let email = email.to_string();
+    let role = role.clone();
+
+    run_blocking!({
+        let mut conn = pool.get()?;
+
+        Ok(organisation_invites::table
+            .filter(organisation_invites::org_id.eq(&org_id))
+            .filter(organisation_invites::email.eq(&email))
+            .filter(organisation_invites::role.eq(&role))
+            .filter(
+                organisation_invites::status.eq(crate::utils::db::models::InviteStatus::Pending),
+            )
+            .first::<OrganisationInviteEntry>(&mut conn)
+            .optional()?)
+    })
+}
+
+/// Update an existing invite's token and created_at timestamp
+async fn update_existing_invite(
+    pool: &DbPool,
+    invite_id: Uuid,
+    new_token: String,
+    apps: Vec<ApplicationAccess>,
+) -> airborne_types::Result<OrganisationInviteEntry> {
+    let pool = pool.clone();
+
+    run_blocking!({
+        let mut conn = pool.get()?;
+
+        Ok(diesel::update(organisation_invites::table.find(invite_id))
+            .set((
+                organisation_invites::token.eq(new_token),
+                organisation_invites::created_at.eq(Utc::now()),
+                organisation_invites::applications
+                    .eq(serde_json::to_value(apps).unwrap_or_default()),
+            ))
+            .get_result::<OrganisationInviteEntry>(&mut conn)?)
+    })
+}
+
+/// Insert a new invite into the database
+async fn create_new_invite(
+    pool: &DbPool,
+    org_id: String,
+    apps: Vec<ApplicationAccess>,
+    email: String,
+    role: InviteRole,
+    token: String,
+) -> airborne_types::Result<OrganisationInviteEntry> {
+    let pool = pool.clone();
+
+    run_blocking!({
+        let mut conn = pool.get()?;
+
+        let new_invite = OrganisationInviteEntry {
+            id: Uuid::new_v4(),
+            org_id,
+            email,
+            role,
+            token,
+            status: crate::utils::db::models::InviteStatus::Pending,
+            created_at: Utc::now(),
+            applications: serde_json::to_value(apps).unwrap_or_default(),
+        };
+
+        Ok(diesel::insert_into(organisation_invites::table)
+            .values(&new_invite)
+            .get_result::<OrganisationInviteEntry>(&mut conn)?)
+    })
+}
+
+/// Generate a secure random token for invite links
+fn generate_invite_token() -> String {
+    use rand::{distributions::Alphanumeric, Rng};
+
+    rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(64)
+        .map(char::from)
+        .collect()
+}
+
+/// Find invite by token
+async fn find_invite_by_token(
+    pool: &DbPool,
+    token: &str,
+) -> airborne_types::Result<Option<OrganisationInviteEntry>> {
+    let pool = pool.clone();
+    let token = token.to_string();
+
+    run_blocking!({
+        let mut conn = pool.get()?;
+
+        Ok(organisation_invites::table
+            .filter(organisation_invites::token.eq(&token))
+            .filter(organisation_invites::status.eq(InviteStatus::Pending))
+            .first::<OrganisationInviteEntry>(&mut conn)
+            .optional()?)
+    })
+}
+
+/// Update invite status to accepted
+pub async fn update_invite_status(
+    pool: &DbPool,
+    invite_id: Uuid,
+    status: InviteStatus,
+) -> airborne_types::Result<OrganisationInviteEntry> {
+    let pool = pool.clone();
+
+    run_blocking!({
+        let mut conn = pool.get()?;
+
+        Ok(diesel::update(organisation_invites::table.find(invite_id))
+            .set(organisation_invites::status.eq(status))
+            .get_result::<OrganisationInviteEntry>(&mut conn)?)
+    })
+}
+
+/// List invites for an organization with search and pagination
+pub async fn list_organization_invites(
+    pool: &DbPool,
+    org_id: &str,
+    search_term: Option<&str>,
+    status_filter: Option<InviteStatus>,
+    page: u32,
+    per_page: u32,
+) -> airborne_types::Result<(Vec<OrganisationInviteEntry>, i64)> {
+    let pool = pool.clone();
+    let org_id = org_id.to_string();
+    let search_term = search_term.map(|s| s.to_string());
+
+    let status_filter = status_filter.to_owned();
+    let search_pattern = if let Some(search) = &search_term {
+        debug!("Searching invites with term: {}", search);
+        Some(format!("%{}%", search.to_lowercase()))
+    } else {
+        None
+    };
+    run_blocking!({
+        let build_query = |org_id: String| {
+            let mut q = organisation_invites::table
+                .filter(organisation_invites::org_id.eq(org_id))
+                .into_boxed();
+
+            if let Some(search) = &search_pattern {
+                q =
+                    q.filter(organisation_invites::email.ilike(search.clone()).or(
+                        sql::<Bool>("LOWER(role::text) LIKE ").bind::<Text, _>(search.clone()),
+                    ));
+            }
+
+            if let Some(status) = status_filter.as_ref() {
+                q = q.filter(organisation_invites::status.eq(status));
+            }
+
+            q
+        };
+
+        let mut conn = pool.get()?;
+
+        let total_count: i64 = build_query(org_id.clone()).count().get_result(&mut conn)?;
+
+        let invites = build_query(org_id.clone())
+            .order(organisation_invites::created_at.desc())
+            .limit(per_page as i64)
+            .offset(((page - 1) * per_page) as i64)
+            .load::<OrganisationInviteEntry>(&mut conn)?;
+
+        Ok((invites, total_count))
+    })
+}
+
+#[post("/{invite_id}/accept")]
+pub async fn accept_invite(
+    req: HttpRequest,
+    body: Json<AcceptInviteRequest>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<InviteRSVPResponse>> {
+    check_invite_feature_enabled(&state.env)?;
+    let request = body.into_inner();
+
+    let auth = req
+        .extensions()
+        .get::<AuthResponse>()
+        .cloned()
+        .ok_or_else(|| ABError::Unauthorized("Missing auth context".to_string()))?;
+
+    let user_email = auth.username.clone();
+
+    let (admin, realm) = prepare_user_action(&req, state.clone())
+        .await
+        .map_err(|e| ABError::InternalServerError(e.to_string()))?;
+
+    rsvp_invitation(
+        admin,
+        realm,
+        &state.db_pool,
+        &request.token,
+        &user_email,
+        InviteAction::Accepted,
+    )
+    .await
+    .map(Json)
+}
+
+#[post("/{invite_id}/decline")]
+pub async fn decline_invite(
+    req: HttpRequest,
+    body: Json<DeclineInviteRequest>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<InviteRSVPResponse>> {
+    check_invite_feature_enabled(&state.env)?;
+    let request = body.into_inner();
+
+    let auth = req
+        .extensions()
+        .get::<AuthResponse>()
+        .cloned()
+        .ok_or_else(|| ABError::Unauthorized("Missing auth context".to_string()))?;
+
+    let user_email = auth.username.clone();
+
+    let (admin, realm) = prepare_user_action(&req, state.clone())
+        .await
+        .map_err(|e| ABError::InternalServerError(e.to_string()))?;
+
+    rsvp_invitation(
+        admin,
+        realm,
+        &state.db_pool,
+        &request.token,
+        &user_email,
+        InviteAction::Declined,
+    )
+    .await
+    .map(Json)
+}
+
+pub async fn rsvp_invitation(
+    admin: KeycloakAdmin,
+    realm: String,
+    db_pool: &DbPool,
+    token: &str,
+    user_email: &str,
+    action: InviteAction,
+) -> airborne_types::Result<InviteRSVPResponse> {
+    debug!("Processing invite RSVP");
+
+    let invite = find_invite_by_token(db_pool, token)
+        .await?
+        .ok_or_else(|| ABError::BadRequest("Invalid or expired invite token".to_string()))?;
+
+    if invite.email != user_email {
+        return Err(ABError::Unauthorized(
+            "Invite token does not match authenticated user".to_string(),
+        ));
+    }
+
+    let invite_age = Utc::now().signed_duration_since(invite.created_at);
+    if invite_age.num_days() > 7 {
+        return Err(ABError::BadRequest("Invite token has expired".to_string()));
+    }
+
+    debug!(
+        "Found valid invite for user to join org {} with role {:?}",
+        invite.org_id, invite.role
+    );
+
+    let target_user = find_user_by_username(&admin, &realm, user_email)
+        .await
+        .map_err(|e| ABError::InternalServerError(format!("Keycloak error: {}", e)))?
+        .ok_or_else(|| ABError::NotFound(user_email.to_string()))?;
+
+    let target_user_id = target_user
+        .id
+        .as_ref()
+        .ok_or_else(|| ABError::InternalServerError("User has no ID".to_string()))?
+        .to_string();
+
+    let username = target_user
+        .username
+        .as_ref()
+        .ok_or_else(|| ABError::InternalServerError("User has no username".to_string()))?
+        .to_string();
+
+    let user_context = UserContext {
+        user_id: target_user_id,
+        username,
+    };
+
+    let org_group = find_org_group(&admin, &realm, &invite.org_id)
+        .await
+        .map_err(|e| ABError::InternalServerError(format!("Keycloak error: {}", e)))?
+        .ok_or_else(|| ABError::NotFound(invite.org_id.clone()))?;
+
+    let org_group_id = org_group
+        .id
+        .as_ref()
+        .ok_or_else(|| ABError::InternalServerError("Group has no ID".to_string()))?
+        .to_string();
+
+    let org_context = OrgContext {
+        org_id: invite.org_id.clone(),
+        group_id: org_group_id,
+    };
+
+    let role_name = match invite.role {
+        InviteRole::Admin => "admin",
+        InviteRole::Write => "write",
+        InviteRole::Read => "read",
+    };
+
+    if action == InviteAction::Accepted {
+        debug!(
+            "Adding user to organization {} with role {}",
+            invite.org_id, role_name
+        );
+        update_invite_status(db_pool, invite.id, InviteStatus::Accepted).await?;
+
+        if let Err(e) =
+            add_user_with_transaction(&admin, &realm, &org_context, &user_context, role_name).await
+        {
+            // Revert the invite status back to pending on failure
+            update_invite_status(db_pool, invite.id, InviteStatus::Pending).await?;
+            info!(
+                "Failed to add user to organization {}: {}, reverting invitation status",
+                invite.org_id, e
+            );
+            return Err(ABError::InternalServerError(e.to_string()));
+        }
+
+        let req_applications: Vec<ApplicationAccess> = invite
+            .applications
+            .as_array()
+            .unwrap_or(&vec![])
+            .iter()
+            .filter_map(|app_value| serde_json::from_value(app_value.clone()).ok())
+            .collect();
+
+        for app_access in req_applications {
+            let app_context =
+                find_application(&admin, &realm, &org_context.org_id, &app_access.name)
+                    .await
+                    .map_err(|e| {
+                        ABError::NotFound(format!(
+                            "Failed to find application {}: {}",
+                            app_access.name, e
+                        ))
+                    })?;
+
+            application::user::add_user_with_transaction(
+                &admin,
+                &realm,
+                &app_context,
+                &user_context,
+                match app_access.level {
+                    AccessLvl::Admin => "admin",
+                    AccessLvl::Write => "write",
+                    AccessLvl::Read => "read",
+                },
+            )
+            .await
+            .map_err(|e| {
+                ABError::InternalServerError(format!(
+                    "Failed to add user to application {}: {}",
+                    app_access.name, e
+                ))
+            })?;
+        }
+
+        info!("User accepted invite to organization {}", invite.org_id);
+    } else {
+        debug!("User is declining invite to organization {}", invite.org_id);
+        update_invite_status(db_pool, invite.id, InviteStatus::Declined).await?;
+
+        info!("User declined invite to organization {}", invite.org_id);
+    }
+
+    Ok(InviteRSVPResponse {
+        success: true,
+        message: if action == InviteAction::Accepted {
+            format!(
+                "Successfully joined organization {} as {}",
+                invite.org_id, role_name
+            )
+        } else {
+            format!("Declined invitation to organization {}", invite.org_id)
+        },
+        organization: invite.org_id,
+        role: role_name.to_string(),
+        action,
+    })
+}
+
+#[post("/validate")]
+pub async fn validate_invite(
+    body: Json<ValidateInviteRequest>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<ValidateInviteResponse>> {
+    check_invite_feature_enabled(&state.env)?;
+
+    let request = body.into_inner();
+
+    let invite = find_invite_by_token(&state.db_pool, &request.token)
+        .await?
+        .ok_or_else(|| ABError::NotFound("Invalid or expired invite token".to_string()))?;
+
+    let invite_age = Utc::now().signed_duration_since(invite.created_at);
+    if invite_age.num_days() > 7 {
+        return Err(ABError::BadRequest("Invite token has expired".to_string()));
+    }
+
+    let role_str = match invite.role {
+        InviteRole::Admin => "admin",
+        InviteRole::Write => "write",
+        InviteRole::Read => "read",
+    };
+
+    let status_str = match invite.status {
+        InviteStatus::Pending => "pending",
+        InviteStatus::Accepted => "accepted",
+        InviteStatus::Declined => "declined",
+        InviteStatus::Expired => "expired",
+    };
+
+    Ok(Json(ValidateInviteResponse {
+        invite_id: invite.id.to_string(),
+        valid: true,
+        email: invite.email,
+        organization: invite.org_id,
+        role: role_str.to_string(),
+        status: status_str.to_string(),
+        created_at: invite.created_at.to_rfc3339(),
+        inviter: None,
+    }))
+}
+
+#[get("/list")]
+pub async fn list_invites(
+    req: HttpRequest,
+    query: Query<ListInvitesQuery>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<ListInvitesResponse>> {
+    check_invite_feature_enabled(&state.env)?;
+
+    // Get organization context and validate requester's permissions
+    let (organisation, _) = get_org_context(&req, WRITE, "list invites")
+        .await
+        .map_err(|e| ABError::InternalServerError(e.to_string()))?;
+
+    let query = query.into_inner();
+
+    // Validate and set pagination defaults
+    let page = query.page.unwrap_or(1).max(1);
+    let per_page = query.per_page.unwrap_or(10).clamp(1, 100);
+
+    // Parse status filter if provided
+    let status_filter = if let Some(status_str) = &query.status {
+        match status_str.to_lowercase().as_str() {
+            "pending" => Some(InviteStatus::Pending),
+            "accepted" => Some(InviteStatus::Accepted),
+            "declined" => Some(InviteStatus::Declined),
+            "expired" => Some(InviteStatus::Expired),
+            _ => {
+                return Err(ABError::BadRequest(format!(
+                    "Invalid status filter: {}",
+                    status_str
+                )))
+            }
+        }
+    } else {
+        None
+    };
+
+    debug!(
+        "Listing invites for org {} with search: {:?}, status: {:?}, page: {}, per_page: {}",
+        organisation, query.search, query.status, page, per_page
+    );
+
+    // Get invites from database
+    let (invites, total_count) = list_organization_invites(
+        &state.db_pool,
+        &organisation,
+        query.search.as_deref(),
+        status_filter,
+        page,
+        per_page,
+    )
+    .await?;
+
+    // Convert to response format
+    let invite_items: Vec<InviteListItem> = invites
+        .into_iter()
+        .map(|invite| {
+            let role_str = match invite.role {
+                InviteRole::Admin => "admin",
+                InviteRole::Write => "write",
+                InviteRole::Read => "read",
+            };
+
+            let status_str = match invite.status {
+                InviteStatus::Pending => "pending",
+                InviteStatus::Accepted => "accepted",
+                InviteStatus::Declined => "declined",
+                InviteStatus::Expired => "expired",
+            };
+
+            InviteListItem {
+                id: invite.id.to_string(),
+                email: invite.email,
+                role: role_str.to_string(),
+                status: status_str.to_string(),
+                created_at: invite.created_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+            }
+        })
+        .collect();
+
+    // Calculate pagination info
+    let total_pages = ((total_count as f64) / (per_page as f64)).ceil() as u32;
+
+    let pagination = PaginationInfo {
+        current_page: page,
+        per_page,
+        total_items: total_count,
+        total_pages,
+    };
+
+    debug!(
+        "Found {} invites for organization {} (page {} of {})",
+        invite_items.len(),
+        organisation,
+        page,
+        total_pages
+    );
+
+    Ok(Json(ListInvitesResponse {
+        invites: invite_items,
+        pagination,
+    }))
+}
+
+#[post("/{invite_id}/revoke")]
+pub async fn revoke_invite(
+    req: HttpRequest,
+    invite_id: Path<String>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<OrganisationInviteEntry>> {
+    check_invite_feature_enabled(&state.env)?;
+
+    let (organisation, _) = get_org_context(&req, WRITE, "add user")
+        .await
+        .map_err(|e| ABError::InternalServerError(e.to_string()))?;
+
+    let pool = state.db_pool.clone();
+    let invite_id = Uuid::parse_str(&invite_id.into_inner())
+        .map_err(|e| ABError::BadRequest(format!("Invalid invite ID: {}", e)))?;
+    let invite = run_blocking!({
+        let mut conn = pool.get()?;
+
+        let invite = organisation_invites::table
+            .find(invite_id)
+            .first::<OrganisationInviteEntry>(&mut conn)?;
+
+        if invite.org_id != organisation {
+            return Err(ABError::Forbidden(
+                "You do not have permission to revoke this invite".to_string(),
+            ));
+        }
+
+        Ok(diesel::update(organisation_invites::table.find(invite_id))
+            .set(organisation_invites::status.eq(InviteStatus::Expired))
+            .get_result::<OrganisationInviteEntry>(&mut conn)?)
+    })?;
+
+    Ok(Json(invite))
+}
+
+#[post("")]
+async fn send_invitation(
+    req: HttpRequest,
+    body: Json<UserRequest>,
+    state: web::Data<AppState>,
+) -> airborne_types::Result<Json<UserOperationResponse>> {
+    let body = body.into_inner();
+
+    check_invite_feature_enabled(&state.env)?;
+
+    let mailer = state.mailer.as_ref().ok_or_else(|| {
+        ABError::InternalServerError(
+            "Mailer not configured, check your SMTP configuration".to_string(),
+        )
+    })?;
+
+    let tera = state.tera.as_ref().ok_or_else(|| {
+        ABError::InternalServerError("Template engine not configured".to_string())
+    })?;
+
+    // Get organization context and validate requester's permissions
+    let (organisation, auth) = get_org_context(&req, WRITE, "add user").await?;
+
+    // Prepare Keycloak admin client
+    let (admin, realm) = prepare_user_action(&req, state.clone())
+        .await
+        .map_err(|e| ABError::InternalServerError(e.to_string()))?;
+
+    // Validate access level
+    let (role_name, role_level) = validate_access_level(&body.access.as_str())?;
+
+    // Additional permission check for admin/owner assignments
+    if role_level >= ADMIN.access {
+        if let Some(org_access) = &auth.organisation {
+            if org_access.level < ADMIN.access {
+                return Err(OrgError::PermissionDenied(
+                    "Admin permission required to assign admin or owner roles".into(),
+                )
+                .into());
+            }
+        } else {
+            return Err(ABError::Forbidden("No organization access".to_string()));
+        }
+    }
+
+    let _ = find_organization(&admin, &realm, &organisation).await?;
+
+    let invite_role = body.access.to_invite_role();
+
+    // Check if there's an existing pending invite for same org, email, and role
+    match find_existing_pending_invite(&state.db_pool, &organisation, &body.user, &invite_role)
+        .await
+    {
+        Ok(Some(existing_invite)) => {
+            // Update existing invite with new token and timestamp
+            let new_token = generate_invite_token();
+            match update_existing_invite(
+                &state.db_pool,
+                existing_invite.id,
+                new_token.clone(),
+                body.applications.unwrap_or_default(),
+            )
+            .await
+            {
+                Ok(_updated_invite) => {
+                    info!(
+                        "Updated existing invite for {} in org {}",
+                        &body.user, &organisation
+                    );
+
+                    let invitation_url =
+                        format!("{}/invitation/{}", &state.env.public_url, &new_token);
+
+                    // Send email with updated invite
+                    let mut context = tera::Context::new();
+                    context.insert("name", &body.user);
+                    context.insert("organization", &organisation);
+                    context.insert("role", &role_name);
+                    context.insert("invitation_url", &invitation_url);
+
+                    let mail = Mail::new(
+                        mailer,
+                        tera,
+                        context,
+                        body.user.clone(),
+                        "You're invited to join an Airborne organization".to_string(),
+                        "org_invitation.txt".to_string(),
+                        Some("org_invitation.html".to_string()),
+                    );
+
+                    mail.send().await?;
+
+                    Ok(Json(UserOperationResponse {
+                        user: body.user,
+                        success: true,
+                        operation: "invite_updated".to_string(),
+                    }))
+                }
+                Err(e) => Err(e),
+            }
+        }
+        Ok(None) => {
+            // No existing invite - create new one
+            let new_token = generate_invite_token();
+            match create_new_invite(
+                &state.db_pool,
+                organisation.clone(),
+                body.applications.unwrap_or_default(),
+                body.user.clone(),
+                invite_role,
+                new_token.clone(),
+            )
+            .await
+            {
+                Ok(_new_invite) => {
+                    info!(
+                        "Created new invite for {} in org {}",
+                        &body.user, &organisation
+                    );
+
+                    let invitation_url =
+                        format!("{}/invitation/{}", &state.env.public_url, &new_token);
+
+                    // Send email with new invite
+                    let mut context = tera::Context::new();
+                    context.insert("name", &body.user);
+                    context.insert("organization", &organisation);
+                    context.insert("role", &role_name);
+                    context.insert("invitation_url", &invitation_url);
+
+                    let mail = Mail::new(
+                        mailer,
+                        tera,
+                        context,
+                        body.user.clone(),
+                        "You're invited to join an Airborne organization".to_string(),
+                        "org_invitation.txt".to_string(),
+                        Some("org_invitation.html".to_string()),
+                    );
+
+                    if let Err(e) = mail.send().await {
+                        info!("Failed to send invitation email to {}: {}", &body.user, e);
+                        // Remove this invite from db if email sending fails
+                        let _ = run_blocking!({
+                            let mut conn = state.db_pool.get()?;
+
+                            Ok(
+                                diesel::delete(organisation_invites::table.find(_new_invite.id))
+                                    .execute(&mut conn)?,
+                            )
+                        });
+                        return Err(e);
+                    }
+
+                    Ok(Json(UserOperationResponse {
+                        user: body.user,
+                        success: true,
+                        operation: "invite_created".to_string(),
+                    }))
+                }
+                Err(e) => Err(e),
+            }
+        }
+        Err(e) => Err(e),
+    }
+}
+
+pub fn check_invite_feature_enabled(
+    env: &airborne_types::Environment,
+) -> airborne_types::Result<()> {
+    if !env.enable_organisation_invite {
+        return Err(ABError::Forbidden(
+            "Organization invitations are disabled".to_string(),
+        ));
+    }
+    Ok(())
+}
diff --git a/airborne_server/src/organisation/user/invite/types.rs b/airborne_server/src/organisation/user/invite/types.rs
new file mode 100644
index 00000000..3f8d717e
--- /dev/null
+++ b/airborne_server/src/organisation/user/invite/types.rs
@@ -0,0 +1,71 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Deserialize)]
+pub struct AcceptInviteRequest {
+    pub token: String,
+}
+
+pub type DeclineInviteRequest = AcceptInviteRequest;
+
+#[derive(Serialize)]
+pub struct InviteRSVPResponse {
+    pub success: bool,
+    pub message: String,
+    pub organization: String,
+    pub role: String,
+    pub action: InviteAction,
+}
+
+#[derive(Serialize, PartialEq, Debug)]
+pub enum InviteAction {
+    Accepted,
+    Declined,
+}
+
+#[derive(Deserialize)]
+pub struct ListInvitesQuery {
+    pub search: Option<String>,
+    pub status: Option<String>,
+    pub page: Option<u32>,
+    pub per_page: Option<u32>,
+}
+
+#[derive(Serialize)]
+pub struct InviteListItem {
+    pub id: String,
+    pub email: String,
+    pub role: String,
+    pub status: String,
+    pub created_at: String,
+}
+
+#[derive(Serialize)]
+pub struct ListInvitesResponse {
+    pub invites: Vec<InviteListItem>,
+    pub pagination: PaginationInfo,
+}
+
+#[derive(Serialize)]
+pub struct PaginationInfo {
+    pub current_page: u32,
+    pub per_page: u32,
+    pub total_items: i64,
+    pub total_pages: u32,
+}
+
+#[derive(Deserialize)]
+pub struct ValidateInviteRequest {
+    pub token: String,
+}
+
+#[derive(Serialize)]
+pub struct ValidateInviteResponse {
+    pub invite_id: String,
+    pub valid: bool,
+    pub email: String,
+    pub organization: String,
+    pub role: String,
+    pub status: String,
+    pub created_at: String,
+    pub inviter: Option<String>,
+}
diff --git a/airborne_server/src/organisation/user/types.rs b/airborne_server/src/organisation/user/types.rs
index 0f2dfbeb..60a5f937 100644
--- a/airborne_server/src/organisation/user/types.rs
+++ b/airborne_server/src/organisation/user/types.rs
@@ -1,6 +1,8 @@
 use serde::{Deserialize, Serialize};
 
-#[derive(Deserialize, Debug)]
+use crate::utils::db::models::InviteRole;
+
+#[derive(Deserialize, Serialize, Debug)]
 #[serde(rename_all = "lowercase")]
 pub enum AccessLvl {
     Admin,
@@ -16,11 +18,27 @@ impl AccessLvl {
             Self::Read => "read".to_string(),
         }
     }
+
+    pub fn to_invite_role(&self) -> InviteRole {
+        match self {
+            Self::Admin => InviteRole::Admin,
+            Self::Write => InviteRole::Write,
+            Self::Read => InviteRole::Read,
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize)]
+pub struct ApplicationAccess {
+    pub name: String,
+    pub level: AccessLvl,
 }
+
 #[derive(Deserialize)]
 pub struct UserRequest {
     pub user: String,
     pub access: AccessLvl,
+    pub applications: Option<Vec<ApplicationAccess>>,
 }
 
 #[derive(Deserialize)]
diff --git a/airborne_server/src/types.rs b/airborne_server/src/types.rs
index 161acc2d..9db8a887 100644
--- a/airborne_server/src/types.rs
+++ b/airborne_server/src/types.rs
@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use std::sync::Arc;
+
 use actix_web::{
     body::BoxBody,
     http::{header::HeaderMap, StatusCode},
@@ -21,9 +23,11 @@ use diesel::result::{DatabaseErrorKind, Error as DieselErr};
 use google_sheets4::{hyper_rustls, hyper_util, Sheets};
 use http::{HeaderName, HeaderValue};
 use keycloak::KeycloakError;
+use lettre::SmtpTransport;
 use log::error;
 use serde::{Deserialize, Deserializer, Serialize};
 use superposition_sdk::Client;
+use tera::Tera;
 use thiserror::Error;
 
 use crate::{
@@ -41,6 +45,8 @@ pub struct AppState {
     pub sheets_hub: Option<
         Sheets<hyper_rustls::HttpsConnector<hyper_util::client::legacy::connect::HttpConnector>>,
     >,
+    pub mailer: Option<Arc<SmtpTransport>>,
+    pub tera: Option<Arc<Tera>>,
 }
 
 #[derive(Clone, Debug)]
@@ -59,6 +65,7 @@ pub struct Environment {
     pub google_spreadsheet_id: String,
     pub cloudfront_distribution_id: String,
     pub default_configs: Vec<SuperpositionDefaultConfig>,
+    pub enable_organisation_invite: bool,
 }
 pub trait AppError: std::error::Error + Send + Sync + 'static {
     fn code(&self) -> &'static str;
diff --git a/airborne_server/src/utils.rs b/airborne_server/src/utils.rs
index 5beb7528..1be889cc 100644
--- a/airborne_server/src/utils.rs
+++ b/airborne_server/src/utils.rs
@@ -18,6 +18,7 @@ pub mod document;
 pub mod encryption;
 pub mod keycloak;
 pub mod kms;
+pub mod mail;
 pub mod migrations;
 pub mod s3;
 pub mod semver;
diff --git a/airborne_server/src/utils/db/models.rs b/airborne_server/src/utils/db/models.rs
index 150d7eba..8895f385 100644
--- a/airborne_server/src/utils/db/models.rs
+++ b/airborne_server/src/utils/db/models.rs
@@ -1,14 +1,85 @@
 use chrono::{DateTime, Utc};
-use diesel::deserialize::Queryable;
+use diesel::deserialize::{FromSql, Queryable};
+use diesel::pg::{Pg, PgValue};
 use diesel::prelude::*;
+use diesel::serialize::{Output, ToSql};
+use diesel::{AsExpression, FromSqlRow};
 use serde::{Deserialize, Serialize};
+use std::io::Write;
 
 use crate::utils::db::schema::hyperotaserver::{
-    builds, cleanup_outbox, configs, files, packages, packages_v2, release_views, releases,
-    user_credentials, workspace_names,
+    builds, cleanup_outbox, configs, files, organisation_invites, packages, packages_v2,
+    release_views, releases, user_credentials, workspace_names,
 };
 use crate::utils::semver::SemVer;
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, AsExpression, FromSqlRow)]
+#[diesel(sql_type = crate::utils::db::schema::hyperotaserver::sql_types::InviteRole)]
+pub enum InviteRole {
+    Admin,
+    Read,
+    Write,
+}
+
+impl ToSql<crate::utils::db::schema::hyperotaserver::sql_types::InviteRole, Pg> for InviteRole {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Pg>) -> diesel::serialize::Result {
+        let value = match self {
+            InviteRole::Admin => "admin",
+            InviteRole::Read => "read",
+            InviteRole::Write => "write",
+        };
+        out.write_all(value.as_bytes())?;
+        Ok(diesel::serialize::IsNull::No)
+    }
+}
+
+impl FromSql<crate::utils::db::schema::hyperotaserver::sql_types::InviteRole, Pg> for InviteRole {
+    fn from_sql(bytes: PgValue<'_>) -> diesel::deserialize::Result<Self> {
+        match std::str::from_utf8(bytes.as_bytes())? {
+            "admin" => Ok(InviteRole::Admin),
+            "read" => Ok(InviteRole::Read),
+            "write" => Ok(InviteRole::Write),
+            _ => Err("Unrecognized enum variant".into()),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, AsExpression, FromSqlRow)]
+#[diesel(sql_type = crate::utils::db::schema::hyperotaserver::sql_types::InviteStatus)]
+pub enum InviteStatus {
+    Pending,
+    Accepted,
+    Declined,
+    Expired,
+}
+
+impl ToSql<crate::utils::db::schema::hyperotaserver::sql_types::InviteStatus, Pg> for InviteStatus {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Pg>) -> diesel::serialize::Result {
+        let value = match self {
+            InviteStatus::Pending => "pending",
+            InviteStatus::Accepted => "accepted",
+            InviteStatus::Declined => "declined",
+            InviteStatus::Expired => "expired",
+        };
+        out.write_all(value.as_bytes())?;
+        Ok(diesel::serialize::IsNull::No)
+    }
+}
+
+impl FromSql<crate::utils::db::schema::hyperotaserver::sql_types::InviteStatus, Pg>
+    for InviteStatus
+{
+    fn from_sql(bytes: PgValue<'_>) -> diesel::deserialize::Result<Self> {
+        match std::str::from_utf8(bytes.as_bytes())? {
+            "pending" => Ok(InviteStatus::Pending),
+            "accepted" => Ok(InviteStatus::Accepted),
+            "declined" => Ok(InviteStatus::Declined),
+            "expired" => Ok(InviteStatus::Expired),
+            _ => Err("Unrecognized enum variant".into()),
+        }
+    }
+}
+
 #[derive(Debug, Deserialize, Serialize, Clone)]
 pub struct File {
     pub url: String,
@@ -192,3 +263,16 @@ pub struct UserCredentialsEntry {
     pub application: String,
     pub created_at: DateTime<Utc>,
 }
+
+#[derive(Queryable, Insertable, Debug, Selectable, Serialize)]
+#[diesel(table_name = organisation_invites)]
+pub struct OrganisationInviteEntry {
+    pub id: uuid::Uuid,
+    pub org_id: String,
+    pub applications: serde_json::Value,
+    pub email: String,
+    pub role: InviteRole,
+    pub token: String,
+    pub status: InviteStatus,
+    pub created_at: DateTime<Utc>,
+}
diff --git a/airborne_server/src/utils/db/schema.rs b/airborne_server/src/utils/db/schema.rs
index 77374026..0acce511 100644
--- a/airborne_server/src/utils/db/schema.rs
+++ b/airborne_server/src/utils/db/schema.rs
@@ -1,6 +1,40 @@
 // @generated automatically by Diesel CLI.
 
 pub mod hyperotaserver {
+    pub mod sql_types {
+        #[derive(diesel::query_builder::QueryId, Clone, diesel::sql_types::SqlType)]
+        #[diesel(postgres_type(name = "invite_role", schema = "hyperotaserver"))]
+        pub struct InviteRole;
+
+        #[derive(diesel::query_builder::QueryId, Clone, diesel::sql_types::SqlType)]
+        #[diesel(postgres_type(name = "invite_status", schema = "hyperotaserver"))]
+        pub struct InviteStatus;
+    }
+
+    diesel::table! {
+        hyperotaserver.application_settings (id) {
+            id -> Uuid,
+            version -> Int4,
+            org_id -> Text,
+            app_id -> Text,
+            maven_namespace -> Text,
+            maven_artifact_id -> Text,
+            maven_group_id -> Text,
+            created_at -> Timestamptz,
+        }
+    }
+
+    diesel::table! {
+        hyperotaserver.builds (id) {
+            id -> Uuid,
+            build_version -> Text,
+            organisation -> Text,
+            application -> Text,
+            release_id -> Text,
+            created_at -> Timestamptz,
+        }
+    }
+
     diesel::table! {
         hyperotaserver.cleanup_outbox (transaction_id) {
             transaction_id -> Text,
@@ -44,6 +78,23 @@ pub mod hyperotaserver {
         }
     }
 
+    diesel::table! {
+        use diesel::sql_types::*;
+        use super::sql_types::InviteRole;
+        use super::sql_types::InviteStatus;
+
+        hyperotaserver.organisation_invites (id) {
+            id -> Uuid,
+            org_id -> Text,
+            applications -> Jsonb,
+            email -> Text,
+            role -> InviteRole,
+            token -> Text,
+            status -> InviteStatus,
+            created_at -> Timestamptz,
+        }
+    }
+
     diesel::table! {
         hyperotaserver.packages (id) {
             id -> Uuid,
@@ -115,22 +166,13 @@ pub mod hyperotaserver {
         }
     }
 
-    diesel::table! {
-        hyperotaserver.builds (id) {
-            id -> Uuid,
-            build_version -> Text,
-            organisation -> Text,
-            application -> Text,
-            release_id -> Text,
-            created_at -> Timestamptz,
-        }
-    }
-
     diesel::allow_tables_to_appear_in_same_query!(
-        cleanup_outbox,
+        application_settings,
         builds,
+        cleanup_outbox,
         configs,
         files,
+        organisation_invites,
         packages,
         packages_v2,
         release_views,
diff --git a/airborne_server/src/utils/mail.rs b/airborne_server/src/utils/mail.rs
new file mode 100644
index 00000000..e6f3faf8
--- /dev/null
+++ b/airborne_server/src/utils/mail.rs
@@ -0,0 +1,101 @@
+use std::sync::Arc;
+
+use lettre::{message::Mailbox, Address, Message, SmtpTransport, Transport};
+use log::error;
+use tera::Tera;
+
+use crate::{run_blocking, types::ABError};
+
+pub struct Mail<'a> {
+    pub smtp_transport: &'a Arc<SmtpTransport>,
+    pub tera: &'a Arc<Tera>,
+    pub context: tera::Context,
+    pub to: String,
+    pub subject: String,
+    pub text_body_template: String,
+    pub html_body_template: Option<String>,
+}
+
+impl<'a> Mail<'a> {
+    pub fn new(
+        smtp_transport: &'a Arc<SmtpTransport>,
+        tera: &'a Arc<Tera>,
+        context: tera::Context,
+        to: String,
+        subject: String,
+        text_body_template: String,
+        html_body_template: Option<String>,
+    ) -> Self {
+        Mail {
+            smtp_transport,
+            tera,
+            to,
+            subject,
+            text_body_template,
+            html_body_template,
+            context,
+        }
+    }
+
+    pub async fn send(&self) -> Result<(), ABError> {
+        let tera = self.tera.clone();
+        let context = self.context.clone();
+        let text_body_template = self.text_body_template.clone();
+        let text_body = run_blocking!({
+            tera.render(&text_body_template, &context).map_err(|e| {
+                ABError::InternalServerError(format!("Template rendering error: {}", e))
+            })
+        })?;
+
+        let email_builder = Message::builder()
+            .from(Mailbox::new(
+                Some("Airborne No Reply".to_owned()),
+                "no-reply@airborne.io".parse().unwrap(),
+            ))
+            .to(Mailbox::new(
+                None,
+                self.to.parse::<Address>().map_err(|e| {
+                    ABError::InternalServerError(format!("Invalid email address: {}", e))
+                })?,
+            ))
+            .subject(self.subject.clone());
+
+        let email = match &self.html_body_template {
+            Some(html_body_template) => {
+                let tera = self.tera.clone();
+                let context = self.context.clone();
+                let html_body_template = html_body_template.clone();
+                let html_body = run_blocking!({
+                    tera.render(&html_body_template, &context).map_err(|e| {
+                        ABError::InternalServerError(format!("Template rendering error: {}", e))
+                    })
+                })?;
+
+                email_builder
+                    .multipart(
+                        lettre::message::MultiPart::alternative()
+                            .singlepart(lettre::message::SinglePart::plain(text_body.clone()))
+                            .singlepart(lettre::message::SinglePart::html(html_body.clone())),
+                    )
+                    .map_err(|e| {
+                        ABError::InternalServerError(format!("Email building error: {}", e))
+                    })?
+            }
+            None => email_builder
+                .singlepart(lettre::message::SinglePart::plain(text_body.clone()))
+                .map_err(|e| {
+                    ABError::InternalServerError(format!("Email building error: {}", e))
+                })?,
+        };
+
+        let mailer = self.smtp_transport.clone();
+        let _ = run_blocking!({
+            mailer.send(&email).map_err(|e| {
+                error!("Could not send email: {:?}", e);
+                ABError::InternalServerError(format!("Email sending error: {}", e))
+            })
+        })?;
+
+        Ok(())
+    }
+}
diff --git a/airborne_server/templates/org_invitation.html b/airborne_server/templates/org_invitation.html
new file mode 100644
index 00000000..1d84cab2
--- /dev/null
+++ b/airborne_server/templates/org_invitation.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Invitation to join {{ organization }} on Airborne</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="margin:0; padding:0; background-color:#f9f9fb; font-family:Inter, Arial, sans-serif;">
+
+  <table width="100%" cellpadding="0" cellspacing="0" border="0" bgcolor="#f9f9fb" style="padding:20px 0;">
+    <tr>
+      <td align="center">
+        <table width="600" cellpadding="0" cellspacing="0" border="0" style="background:#ffffff; border-radius:8px; border:1px solid #e5e7eb;">
+          <!-- Header -->
+          <tr>
+            <td align="center" style="padding:40px 20px 20px;">
+              <img alt="Airborne Logo" width="120" style="display:block; margin-bottom:24px; width: 80px;" src="https://airborne.juspay.in/favicon/web-app-manifest-512x512.png" />
+              <h1 style="font-size:28px; font-weight:700; color:#111827; margin:0; font-family:'Space Grotesk', Arial, sans-serif;">You're invited!</h1>
+              <p style="font-size:16px; color:#6b7280; margin:8px 0 0;">Join your team and start building with Airborne</p>
+            </td>
+          </tr>
+
+          <!-- Content -->
+          <tr>
+            <td style="padding:0 32px 32px; color:#111827;">
+              <p style="font-size:16px; margin:24px 0 12px;">Hello,</p>
+
+              <p style="font-size:16px; margin:0 0 24px;">
+                You've been invited to join <strong style="color:#4f46e5;">{{ organization }}</strong>
+                on Airborne with
+                <span style="background:#4f46e5; color:#ffffff; border-radius:4px; padding:2px 8px; font-size:14px;">{{ role }}</span>
+                access.
+              </p>
+
+              <!-- Features -->
+              <table width="100%" cellpadding="0" cellspacing="0" border="0" style="background:#f3f4f6; border-radius:6px; padding:16px; border:1px solid #e5e7eb;">
+                <tr>
+                  <td>
+                    <h3 style="font-size:16px; font-weight:600; margin:0 0 12px;">Airborne helps you to:</h3>
+                    <ul style="padding-left:20px; margin:0;">
+                      <li style="font-size:14px; margin-bottom:6px;">🚀 Deploy and manage applications seamlessly</li>
+                      <li style="font-size:14px; margin-bottom:6px;">📊 Real-time analytics and performance monitoring</li>
+                      <li style="font-size:14px; margin-bottom:6px;">🔒 Enterprise-grade security and access controls</li>
+                      <li style="font-size:14px; margin-bottom:6px;">👥 Collaborate with your team members</li>
+                      <li style="font-size:14px;">⚡ Advanced targeting and rollout controls</li>
+                    </ul>
+                  </td>
+                </tr>
+              </table>
+
+              <!-- CTA -->
+              <div style="text-align:center; margin:32px 0 16px;">
+                <p style="font-size:16px; color:#111827; margin-bottom:20px;">Ready to get started? Accept your invitation to join the team:</p>
+                <a href="{{ invitation_url }}" style="background:#4f46e5; color:#ffffff; text-decoration:none; padding:12px 24px; border-radius:6px; display:inline-block; font-weight:600; font-size:16px;">
+                  Accept Invitation
+                </a>
+              </div>
+
+              <!-- Note -->
+              <div style="background:#fff8e1; border:1px solid #facc15; padding:12px 16px; border-radius:6px; margin-top:24px;">
+                <p style="font-size:14px; color:#92400e; margin:0;">
+                  <strong>Important:</strong> This invitation will expire in 7 days. If you have any questions or need assistance, please reach out to your team administrator or our support team.
+                </p>
+              </div>
+            </td>
+          </tr>
+
+          <!-- Footer -->
+          <tr>
+            <td align="center" style="background:#f3f4f6; padding:24px; border-top:1px solid #e5e7eb;">
+              <p style="font-size:14px; color:#6b7280; margin:0 0 8px;">This email was sent by Airborne on behalf of <strong>{{ organization }}</strong></p>
+              <p style="font-size:14px; color:#6b7280; margin:0 0 16px;">If you believe this email was sent to you by mistake, you can safely ignore it.</p>
+              <p style="margin:0;">
+                <a href="https://airborne.juspay.in" style="color:#4f46e5; text-decoration:none; font-size:14px;">Learn more</a> ·
+                <a href="mailto:superposition@juspay.in" style="color:#4f46e5; text-decoration:none; font-size:14px;">Contact Support</a> ·
+                <a href="https://airborne.juspay.in/docs/home" style="color:#4f46e5; text-decoration:none; font-size:14px;">Documentation</a>
+              </p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+
+</body>
+</html>
diff --git a/airborne_server/templates/org_invitation.txt b/airborne_server/templates/org_invitation.txt
new file mode 100644
index 00000000..0100885f
--- /dev/null
+++ b/airborne_server/templates/org_invitation.txt
@@ -0,0 +1,22 @@
+Hi,
+
+You’ve been invited to join {{ organization }} on Airborne as a {{ role }}.
+
+Airborne helps you to:
+1. Deploy and manage applications seamlessly
+2. Monitor performance and analytics in real time
+3. Benefit from enterprise-grade security and access controls
+4. Collaborate with your team members
+5. Explore advanced rollout and targeting controls
+
+To get started, please accept your invitation here: {{ invitation_url }}
+
+This invitation will expire in 7 days. If you have any questions or need assistance, contact your team administrator or reach out to our support team at superposition@juspay.in.
+
+This email was sent by Airborne on behalf of {{ organization }}.
+If you believe this was sent to you by mistake, you can safely ignore it.
+
+Learn more about Airborne: https://airborne.juspay.in
+Documentation: https://airborne.juspay.in/docs/home
+—
+The Airborne Team
\ No newline at end of file