User Invite — Edge mTLS POC

Calls go through CloudFront → Lambda@Edge → mTLS → invite API. API key injected at edge from x-requesting-for. CSRF bypassed on invite/verify via mTLS host.

x-requesting-for (consumer) Origin header (CSRF token mint) Email (verify / invite)

CSRF token stored in memory after step 1. Steps 2–3 send it from browser; edge strips it for mTLS upstream.

Ready.