Public marketplace and application pages are open. Creator, company, and operations dashboards require an approved invite.
Invite codes are checked server-side and sessions use HTTP-only cookies.
Use the email and role attached to your invite.