- Shipped
- August 26, 2026 at 5:18 PM UTC
- Author
- kamo
- Commit
- 75ed1f2
The invitation now has somewhere to go — the portal lives on apps.<practice> — so the panel shows the whole activation URL with a copy button rather than the opaque string the server issues. A patient handed a bare token has to work out where it goes. The ones who guess wrong paste a working key to their medical record into a search box. The mapping is a subdomain swap off the staff host, the mirror image of the assumption the apps site already makes about register.*, so no backend has to learn about front-end hostnames. A host that is not a tenant subdomain falls back to the token: a developer on localhost gets something usable rather than a link to a domain that does not exist.