email addresses are not good primary or foreign keys, so yes you should be using IDs of one form or another. this shouldn't affect your authentication scheme (cookies vs bearer tokens or what have you), just authorization. if you've muddied the two, you'll have some debt to resolve and this issue could just be a valuable tip-off to that

▲

hawtads 3 hours ago | parent [-]

I think OP is referring to the initial sign up based on an invite link, not the database storage itself.

It depends whether you want to check the invite code against the invitee's email. It very much depends on the application. For most use cases, just verifying the code is fine and accept any email addresses that posses it.

Essentially ask yourself this, if you change the UI a bit and allow any user to sign up with any email, and the workspace joining is done via a code they enter after login, is that acceptable for your product design and security posture.

	▲	Rumudiez 3 hours ago \| parent [-]
		okay, I have that use case as well and it is driven by an invite code. it works well for new sign-ups and existing users, and you can even just let the user copy the link and send it themselves if they're on discord or something else. no email required for pseudonymous sharing, bonus feature to send an email invite if it is given