Checks in order
- Confirm the invitation has not expired — resend if unsure
- Confirm the account is in the correct workspace
- For API keys: check the header is Authorization: Bearer <key>
- For API keys: confirm the key has not been rotated by a teammate
Sign-in failures, expired invitations and rejected API keys.