The door

Bring the invite.

Email and a password. A new account also spends a single-use invite. The session is a cookie. Owner access is an app metadata role, not a second code.