Occasionally an invited user reports their invite link shows "token expired" the very first time they open it — before they've ever had a chance to click it themselves. This is usually caused by their company's email security tooling automatically pre-fetching links in incoming email to scan them for safety. That automated visit consumes the one-time verification token, so by the time the real person clicks the link, it's already been used and shows as expired.

Because the token is single-use, resending the invite doesn't fix this — the new link just gets pre-scanned and burned the same way. If a user is stuck like this, use the two-step workaround below instead.

Go to Setup → Settings → Users, find the affected user (they'll show status Invite Sent), and open the row actions menu:

Click Mark Email As Verified. You'll get a confirmation before it takes effect:

This bypasses the normal emailed-link verification entirely and marks the account verified immediately — only use it when a user genuinely can't complete verification via the link, since it skips the usual confirmation that the email address is real and reachable by that person.

From the same row actions menu, click Reset Password:

Set a temporary password and share it with the user through a separate, trusted channel (Slack DM, phone, in person) — not the same email thread that triggered the scanner issue in the first place:

The user can now log in directly with that temporary password and change it themselves once they're in, rather than depending on a link at all.