diff --git a/TERMINOLOGY.md b/TERMINOLOGY.md
index 25760925e..23422aa7e 100644
--- a/TERMINOLOGY.md
+++ b/TERMINOLOGY.md
@@ -73,6 +73,7 @@ All user-facing wording in docs, UI, and API descriptions must follow this table
 | Password changed | Past-tense wording for password change notification | Password change | Password changed | replace | UI notifications |
 | Object descriptions | All resource descriptions must use end-user language | internal / technical wording | clear end-user language | replace | UI + Docs |
 | Complement Token | Flow type for actions executed during token creation. In UI use "Complement Token"; in API use `flowType = 2` (CustomiseToken). Docs must not show PreUserinfoCreation=3 for this type. | Compliment Token, CustomiseToken, CustomizeToken | Complement Token | replace | Everywhere |
+| Invite Code | One-time code used to invite a user to set up authentication (secret generator and user-invite flows) | Invitation Code, Invitation code | Invite Code | replace | UI + Docs |
 
 ## Governance
 
diff --git a/apps/docs/content/guides/manage/console/default-settings.mdx b/apps/docs/content/guides/manage/console/default-settings.mdx
index afeb1c887..10de697e9 100644
--- a/apps/docs/content/guides/manage/console/default-settings.mdx
+++ b/apps/docs/content/guides/manage/console/default-settings.mdx
@@ -387,6 +387,7 @@ The following secrets can be specified:
 - Application secrets
 - One Time Password (OTP) - SMS
 - One Time Password (OTP) - Email
+- Invite Code
 
 <img
   src="/docs/img/guides/console/secretappearance.png"
diff --git a/backend/v3/domain/settings.go b/backend/v3/domain/settings.go
index b84279232..1691b725d 100644
--- a/backend/v3/domain/settings.go
+++ b/backend/v3/domain/settings.go
@@ -476,6 +476,7 @@ type SecretGeneratorSettingsAttributes struct {
 	DomainVerification       *DomainVerificationAttributes       `json:"domainVerification,omitempty"`
 	OTPSMS                   *OTPSMSAttributes                   `json:"otpSms,omitempty"`
 	OTPEmail                 *OTPEmailAttributes                 `json:"otpEmail,omitempty"`
+	InviteCode               *InviteCodeAttributes               `json:"inviteCode,omitempty"`
 }
 
 type ClientSecretAttributes struct {
@@ -514,6 +515,10 @@ type OTPEmailAttributes struct {
 	SecretGeneratorAttrsWithExpiry
 }
 
+type InviteCodeAttributes struct {
+	SecretGeneratorAttrsWithExpiry
+}
+
 type SecretGeneratorAttrs struct {
 	Length              *uint `json:"length,omitempty"`
 	IncludeLowerLetters *bool `json:"includeLowerLetters,omitempty"`
diff --git a/backend/v3/storage/database/events_testing/settings_instance_test.go b/backend/v3/storage/database/events_testing/settings_instance_test.go
index 474d577d5..7fade369e 100644
--- a/backend/v3/storage/database/events_testing/settings_instance_test.go
+++ b/backend/v3/storage/database/events_testing/settings_instance_test.go
@@ -1477,6 +1477,14 @@ func TestServer_TestInstanceSecretGeneratorSettingsReduces(t *testing.T) {
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeUpperLetters)
 			assert.Equal(collect, true, *setting.OTPEmail.IncludeDigits)
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeSymbols)
+
+			// InviteCode
+			assert.Equal(collect, uint(6), *setting.InviteCode.Length)
+			assert.Equal(collect, 72*time.Hour, *setting.InviteCode.Expiry)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeLowerLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeUpperLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeDigits)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeSymbols)
 		}, retryDuration, tick)
 	})
 
diff --git a/backend/v3/storage/database/repository/settings.go b/backend/v3/storage/database/repository/settings.go
index 326cf8f70..29187c746 100644
--- a/backend/v3/storage/database/repository/settings.go
+++ b/backend/v3/storage/database/repository/settings.go
@@ -1456,6 +1456,9 @@ func (s secretGeneratorSettings) SetSettingFields(value domain.SecretGeneratorSe
 	if value.OTPEmail != nil {
 		changes = append(changes, s.SetOTPEmail(*value.OTPEmail))
 	}
+	if value.InviteCode != nil {
+		changes = append(changes, s.SetInviteCode(*value.InviteCode))
+	}
 	return db_json.NewJsonChanges(s.SettingsColumn(), changes...)
 }
 
@@ -1495,6 +1498,10 @@ func (s secretGeneratorSettings) SetOTPEmail(value domain.OTPEmailAttributes) db
 	return db_json.NewFieldChange([]string{"otpEmail"}, value)
 }
 
+func (s secretGeneratorSettings) SetInviteCode(value domain.InviteCodeAttributes) db_json.JsonUpdate {
+	return db_json.NewFieldChange([]string{"inviteCode"}, value)
+}
+
 func SecretGeneratorSettingsRepository() domain.SecretGeneratorSettingsRepository {
 	return &secretGeneratorSettings{
 		settings{},
diff --git a/backend/v3/storage/database/repository/settings_test.go b/backend/v3/storage/database/repository/settings_test.go
index 39c724445..3b3b0813b 100644
--- a/backend/v3/storage/database/repository/settings_test.go
+++ b/backend/v3/storage/database/repository/settings_test.go
@@ -5134,6 +5134,9 @@ func createDefaultSecretGeneratorSettingsAttributes() domain.SecretGeneratorSett
 		OTPEmail: &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(thirtyMinutes),
 		},
+		InviteCode: &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(oneDay * 3),
+		},
 	}
 }
 
@@ -5146,3 +5149,32 @@ func createSecretGeneratorSettings(instanceID string, organizationID *string) *d
 		SecretGeneratorSettingsAttributes: createDefaultSecretGeneratorSettingsAttributes(),
 	}
 }
+
+func TestSecretGeneratorSettingsInviteCodeRoundTrip(t *testing.T) {
+	tx, rollback := transactionForRollback(t)
+	defer rollback()
+
+	instanceID := createInstance(t, tx)
+	repo := repository.SecretGeneratorSettingsRepository()
+
+	want := createSecretGeneratorSettings(instanceID, nil)
+	require.NotNil(t, want.InviteCode)
+
+	err := repo.Set(t.Context(), tx, want)
+	require.NoError(t, err)
+
+	got, err := repo.Get(t.Context(), tx, database.WithCondition(
+		repo.UniqueCondition(instanceID, nil, domain.SettingTypeSecretGenerator, domain.SettingStateActive),
+	))
+	require.NoError(t, err)
+	require.NotNil(t, got.InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, got.InviteCode)
+
+	list, err := repo.List(t.Context(), tx, database.WithCondition(
+		repo.InstanceIDCondition(instanceID),
+	))
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.NotNil(t, list[0].InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, list[0].InviteCode)
+}
diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml
index 79b99b557..d7b151ce9 100644
--- a/cmd/defaults.yaml
+++ b/cmd/defaults.yaml
@@ -1212,12 +1212,12 @@ DefaultInstance:
       IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDEDIGITS
       IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDESYMBOLS
     InviteCode:
-      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_LENGTH
-      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_EXPIRY
-      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDELOWERLETTERS
-      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEUPPERLETTERS
-      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEDIGITS
-      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDESYMBOLS
+      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_LENGTH
+      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_EXPIRY
+      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDELOWERLETTERS
+      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEUPPERLETTERS
+      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEDIGITS
+      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDESYMBOLS
     SigningKey:
       Length: 36 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_LENGTH
       IncludeLowerLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_INCLUDELOWERLETTERS
diff --git a/cmd/mirror/projections.go b/cmd/mirror/projections.go
index e3df16b57..ac15dc697 100644
--- a/cmd/mirror/projections.go
+++ b/cmd/mirror/projections.go
@@ -177,6 +177,7 @@ func projections(
 		0,
 		config.SystemAPIUsers,
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 
diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go
index 2992bc044..c031df36b 100644
--- a/cmd/setup/setup.go
+++ b/cmd/setup/setup.go
@@ -535,6 +535,7 @@ func startCommandsQueries(
 		0,   // not needed for projections
 		nil, // not needed for projections
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 
diff --git a/cmd/start/start.go b/cmd/start/start.go
index 80b719d04..19e520fec 100644
--- a/cmd/start/start.go
+++ b/cmd/start/start.go
@@ -248,6 +248,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
 		config.AuditLogRetention,
 		config.SystemAPIUsers,
 		true,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	if err != nil {
 		return fmt.Errorf("cannot start queries: %w", err)
diff --git a/console/src/app/modules/policies/secret-generator/secret-generator.component.ts b/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
index 1f4867c8a..d3d4aa4ab 100644
--- a/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
+++ b/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
@@ -19,6 +19,7 @@ export class SecretGeneratorComponent {
     SecretGeneratorType.SECRET_GENERATOR_TYPE_APP_SECRET,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_SMS,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_EMAIL,
+    SecretGeneratorType.SECRET_GENERATOR_TYPE_INVITE_CODE,
   ];
 
   constructor() {}
diff --git a/console/src/assets/i18n/ar.json b/console/src/assets/i18n/ar.json
index 9220bc703..f43fe3632 100644
--- a/console/src/assets/i18n/ar.json
+++ b/console/src/assets/i18n/ar.json
@@ -1608,7 +1608,8 @@
         "5": "تهيئة بدون كلمة مرور",
         "6": "سر التطبيق",
         "7": "OTP - SMS",
-        "8": "OTP - بريد إلكتروني"
+        "8": "OTP - بريد إلكتروني",
+        "9": "رمز الدعوة"
       },
       "EXPIRY": "انتهاء الصلاحية (بالدقائق)",
       "INCLUDEDIGITS": "تضمين أرقام",
diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json
index c3450823e..438f856a8 100644
--- a/console/src/assets/i18n/bg.json
+++ b/console/src/assets/i18n/bg.json
@@ -1615,7 +1615,8 @@
         "5": "Инициализация на ключ за достъп",
         "6": "Тайна на приложението",
         "7": "OTP - SMS",
-        "8": "OTP – имейл"
+        "8": "OTP – имейл",
+        "9": "Код за покана"
       },
       "EXPIRY": "Изтичане (в минути)",
       "INCLUDEDIGITS": "Включете числа",
diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json
index 7df3432d0..1211d7386 100644
--- a/console/src/assets/i18n/cs.json
+++ b/console/src/assets/i18n/cs.json
@@ -1613,7 +1613,8 @@
         "5": "Inicializace Passkey",
         "6": "Tajemství pomocí aplikace",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Kód pozvánky"
       },
       "EXPIRY": "Expirace (v minutách)",
       "INCLUDEDIGITS": "Zahrnout čísla",
diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json
index 5aa83ee40..bee10fa67 100644
--- a/console/src/assets/i18n/de.json
+++ b/console/src/assets/i18n/de.json
@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisierungscode",
         "6": "Anwendungsgeheimnis",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Einladungscode"
       },
       "EXPIRY": "Ablauf (in Minuten)",
       "INCLUDEDIGITS": "Enthält Zahlen",
diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json
index c86694ae0..6919ca40a 100644
--- a/console/src/assets/i18n/en.json
+++ b/console/src/assets/i18n/en.json
@@ -1618,7 +1618,8 @@
         "5": "Passkey Initialization",
         "6": "Application Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Invite Code"
       },
       "EXPIRY": "Expiration (in minutes)",
       "INCLUDEDIGITS": "Include Numbers",
diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json
index ddaaf065d..8068c4df9 100644
--- a/console/src/assets/i18n/es.json
+++ b/console/src/assets/i18n/es.json
@@ -1614,7 +1614,8 @@
         "5": "Inicialización de llave de acceso",
         "6": "Secreto de aplicación",
         "7": "One Time Password (OTP) - SMS",
-        "8": "One Time Password (OTP) - email"
+        "8": "One Time Password (OTP) - email",
+        "9": "Código de invitación"
       },
       "EXPIRY": "Caducidad (en minutos)",
       "INCLUDEDIGITS": "Incluir números",
diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json
index 4d7b2364c..759890071 100644
--- a/console/src/assets/i18n/fr.json
+++ b/console/src/assets/i18n/fr.json
@@ -1613,7 +1613,8 @@
         "5": "Initialisation de clé d'accès",
         "6": "Secret de l'application",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Code d'invitation"
       },
       "EXPIRY": "Expiration (en minutes)",
       "INCLUDEDIGITS": "Inclure les chiffres",
diff --git a/console/src/assets/i18n/hu.json b/console/src/assets/i18n/hu.json
index 91703e5d0..5ac10e109 100644
--- a/console/src/assets/i18n/hu.json
+++ b/console/src/assets/i18n/hu.json
@@ -1611,7 +1611,8 @@
         "5": "Passkey inicializálás",
         "6": "Alkalmazás titok",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Meghívókód"
       },
       "EXPIRY": "Lejárat (percben)",
       "INCLUDEDIGITS": "Számok bevonása",
diff --git a/console/src/assets/i18n/id.json b/console/src/assets/i18n/id.json
index e8ce1915d..a09066f8b 100644
--- a/console/src/assets/i18n/id.json
+++ b/console/src/assets/i18n/id.json
@@ -1613,7 +1613,8 @@
         "5": "Inisialisasi Passkey",
         "6": "Rahasia Aplikasi",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Kode Undangan"
       },
       "EXPIRY": "Kedaluwarsa (dalam menit)",
       "INCLUDEDIGITS": "Sertakan Angka",
diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json
index 1b95b8527..e26b69029 100644
--- a/console/src/assets/i18n/it.json
+++ b/console/src/assets/i18n/it.json
@@ -1613,7 +1613,8 @@
         "5": "Inizializzazione passkey",
         "6": "Segreto dell'applicazione",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Codice di invito"
       },
       "EXPIRY": "Scadenza (in minuti)",
       "INCLUDEDIGITS": "Contiene numeri",
diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json
index c2e125c91..d1ee46c57 100644
--- a/console/src/assets/i18n/ja.json
+++ b/console/src/assets/i18n/ja.json
@@ -1613,7 +1613,8 @@
         "5": "パスキーの初期設定",
         "6": "アプリケーションのシークレット",
         "7": "OTP - SMS",
-        "8": "OTP - 電子メール"
+        "8": "OTP - 電子メール",
+        "9": "招待コード"
       },
       "EXPIRY": "有効期限 (分単位)",
       "INCLUDEDIGITS": "数字を含める",
diff --git a/console/src/assets/i18n/ko.json b/console/src/assets/i18n/ko.json
index d68cc73b8..d4ea7e626 100644
--- a/console/src/assets/i18n/ko.json
+++ b/console/src/assets/i18n/ko.json
@@ -1613,7 +1613,8 @@
         "5": "패스키 초기화",
         "6": "애플리케이션 시크릿",
         "7": "OTP - SMS",
-        "8": "OTP - 이메일"
+        "8": "OTP - 이메일",
+        "9": "초대 코드"
       },
       "EXPIRY": "만료 시간 (분)",
       "INCLUDEDIGITS": "숫자 포함",
diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json
index 0b9905255..935267c99 100644
--- a/console/src/assets/i18n/mk.json
+++ b/console/src/assets/i18n/mk.json
@@ -1614,7 +1614,8 @@
         "5": "Иницијализација на Passkey",
         "6": "Апликациска тајна",
         "7": "OTP - СМС",
-        "8": "OTP - е-пошта"
+        "8": "OTP - е-пошта",
+        "9": "Код за покана"
       },
       "EXPIRY": "Истекување (во минути)",
       "INCLUDEDIGITS": "Вклучи цифри",
diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json
index b2d70ffaf..fd830587a 100644
--- a/console/src/assets/i18n/nl.json
+++ b/console/src/assets/i18n/nl.json
@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisatie",
         "6": "Applicatie Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Uitnodigingscode"
       },
       "EXPIRY": "Vervaldatum (in minuten)",
       "INCLUDEDIGITS": "Inclusief Nummers",
diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json
index 888b48128..30c8bd798 100644
--- a/console/src/assets/i18n/pl.json
+++ b/console/src/assets/i18n/pl.json
@@ -1612,7 +1612,8 @@
         "5": "Inicjalizacja passkey",
         "6": "Sekret aplikacji",
         "7": "OTP - SMS",
-        "8": "OTP — e-mail"
+        "8": "OTP — e-mail",
+        "9": "Kod zaproszenia"
       },
       "EXPIRY": "Wygaśnięcie (w minutach)",
       "INCLUDEDIGITS": "Dołącz cyfry",
diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json
index 571d459e8..fbb82161c 100644
--- a/console/src/assets/i18n/pt.json
+++ b/console/src/assets/i18n/pt.json
@@ -1614,7 +1614,8 @@
         "5": "Inicialização passkey",
         "6": "Segredo do aplicativo",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Código de convite"
       },
       "EXPIRY": "Expiração (em minutos)",
       "INCLUDEDIGITS": "Incluir números",
diff --git a/console/src/assets/i18n/ro.json b/console/src/assets/i18n/ro.json
index 336709014..0a4d7e764 100644
--- a/console/src/assets/i18n/ro.json
+++ b/console/src/assets/i18n/ro.json
@@ -1611,7 +1611,8 @@
         "5": "Inițializarea Passkey",
         "6": "Secretul aplicației",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Cod de invitație"
       },
       "EXPIRY": "Expirare (în minute)",
       "INCLUDEDIGITS": "Includeți numere",
diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json
index 8cbbcc8cf..ee6eaf976 100644
--- a/console/src/assets/i18n/ru.json
+++ b/console/src/assets/i18n/ru.json
@@ -1672,7 +1672,8 @@
         "5": "Инициализация ключа доступа",
         "6": "Ключ приложения",
         "7": "OTP — SMS",
-        "8": "OTP – электронная почта"
+        "8": "OTP – электронная почта",
+        "9": "Код приглашения"
       },
       "EXPIRY": "Срок действия (в минутах)",
       "INCLUDEDIGITS": "Содержит цифры",
diff --git a/console/src/assets/i18n/sv.json b/console/src/assets/i18n/sv.json
index d4b41b439..515382478 100644
--- a/console/src/assets/i18n/sv.json
+++ b/console/src/assets/i18n/sv.json
@@ -1617,7 +1617,8 @@
         "5": "Passkey-initiering",
         "6": "Applikations-hemlighet",
         "7": "OTP - SMS",
-        "8": "OTP - E-post"
+        "8": "OTP - E-post",
+        "9": "Inbjudningskod"
       },
       "EXPIRY": "Utgång (på minuter)",
       "INCLUDEDIGITS": "Inkludera siffror",
diff --git a/console/src/assets/i18n/tr.json b/console/src/assets/i18n/tr.json
index 446607971..7ffe7f66c 100644
--- a/console/src/assets/i18n/tr.json
+++ b/console/src/assets/i18n/tr.json
@@ -1616,7 +1616,8 @@
         "5": "Passkey Başlatma",
         "6": "Uygulama Gizli Anahtarı",
         "7": "OTP - SMS",
-        "8": "OTP - E-posta"
+        "8": "OTP - E-posta",
+        "9": "Davet Kodu"
       },
       "EXPIRY": "Son kullanma (dakika cinsinden)",
       "INCLUDEDIGITS": "Sayıları Dahil Et",
diff --git a/console/src/assets/i18n/uk.json b/console/src/assets/i18n/uk.json
index 139c03795..5d93f7f65 100644
--- a/console/src/assets/i18n/uk.json
+++ b/console/src/assets/i18n/uk.json
@@ -1617,7 +1617,8 @@
         "5": "Ініціалізація ключа доступу",
         "6": "Секрет додатка",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Код запрошення"
       },
       "EXPIRY": "Термін дії (у хвилинах)",
       "INCLUDEDIGITS": "Включити цифри",
diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json
index 7f82f148a..6bea72d8e 100644
--- a/console/src/assets/i18n/zh.json
+++ b/console/src/assets/i18n/zh.json
@@ -1616,7 +1616,8 @@
         "5": "Passkey 初始化",
         "6": "应用密钥",
         "7": "OTP - SMS",
-        "8": "OTP - 电子邮件"
+        "8": "OTP - 电子邮件",
+        "9": "邀请码"
       },
       "EXPIRY": "过期时间 (以分钟为单位)",
       "INCLUDEDIGITS": "包含数字",
diff --git a/internal/api/grpc/admin/iam_settings_converter.go b/internal/api/grpc/admin/iam_settings_converter.go
index f3ce470a2..c306eb7db 100644
--- a/internal/api/grpc/admin/iam_settings_converter.go
+++ b/internal/api/grpc/admin/iam_settings_converter.go
@@ -105,6 +105,8 @@ func SecretGeneratorTypeToPb(generatorType domain.SecretGeneratorType) settings_
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_SMS
 	case domain.SecretGeneratorTypeOTPEmail:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL
+	case domain.SecretGeneratorTypeInviteCode:
+		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE
 	default:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_UNSPECIFIED
 	}
@@ -128,6 +130,8 @@ func SecretGeneratorTypeToDomain(generatorType settings_pb.SecretGeneratorType)
 		return domain.SecretGeneratorTypeOTPSMS
 	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL:
 		return domain.SecretGeneratorTypeOTPEmail
+	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE:
+		return domain.SecretGeneratorTypeInviteCode
 	default:
 		return domain.SecretGeneratorTypeUnspecified
 	}
diff --git a/internal/command/instance.go b/internal/command/instance.go
index 63ff4731f..1b879f518 100644
--- a/internal/command/instance.go
+++ b/internal/command/instance.go
@@ -163,6 +163,22 @@ type SecretGenerators struct {
 	SigningKey               *crypto.GeneratorConfig
 }
 
+func (s *SecretGenerators) ToMap() map[domain.SecretGeneratorType]*crypto.GeneratorConfig {
+	return map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+		domain.SecretGeneratorTypeInitCode:             s.InitializeUserCode,
+		domain.SecretGeneratorTypeVerifyEmailCode:      s.EmailVerificationCode,
+		domain.SecretGeneratorTypeVerifyPhoneCode:      s.PhoneVerificationCode,
+		domain.SecretGeneratorTypeVerifyDomain:         s.DomainVerification,
+		domain.SecretGeneratorTypePasswordResetCode:    s.PasswordVerificationCode,
+		domain.SecretGeneratorTypePasswordlessInitCode: s.PasswordlessInitCode,
+		domain.SecretGeneratorTypeAppSecret:            s.ClientSecret,
+		domain.SecretGeneratorTypeOTPSMS:               s.OTPSMS,
+		domain.SecretGeneratorTypeOTPEmail:             s.OTPEmail,
+		domain.SecretGeneratorTypeInviteCode:           s.InviteCode,
+		domain.SecretGeneratorTypeSigningKey:           s.SigningKey,
+	}
+}
+
 type ZitadelConfig struct {
 	instanceID             string
 	orgID                  string
@@ -326,6 +342,7 @@ func setupInstanceElements(instanceAgg *instance.Aggregate, setup *InstanceSetup
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyDomain, setup.SecretGenerators.DomainVerification),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPSMS, setup.SecretGenerators.OTPSMS),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPEmail, setup.SecretGenerators.OTPEmail),
+		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInviteCode, setup.SecretGenerators.InviteCode),
 
 		prepareAddDefaultPasswordComplexityPolicy(
 			instanceAgg,
diff --git a/internal/command/instance_settings.go b/internal/command/instance_settings.go
index 93bbdc831..638c28d4a 100644
--- a/internal/command/instance_settings.go
+++ b/internal/command/instance_settings.go
@@ -35,8 +35,8 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 		if !typ.Valid() {
 			return nil, zerrors.ThrowInvalidArgument(nil, "V2-FGqVj", "Errors.InvalidArgument")
 		}
-		if config.Length < 1 {
-			return nil, zerrors.ThrowInvalidArgument(nil, "V2-jEqCt", "Errors.InvalidArgument")
+		if err := config.Valid(); err != nil {
+			return nil, err
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			writeModel := NewInstanceSecretGeneratorConfigWriteModel(ctx, typ)
@@ -71,9 +71,12 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 }
 
 func (c *Commands) ChangeSecretGeneratorConfig(ctx context.Context, generatorType domain.SecretGeneratorType, config *crypto.GeneratorConfig) (*domain.ObjectDetails, error) {
-	if generatorType == domain.SecretGeneratorTypeUnspecified {
+	if !generatorType.Valid() {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-33k9f", "Errors.SecretGenerator.TypeMissing")
 	}
+	if err := config.Valid(); err != nil {
+		return nil, err
+	}
 
 	generatorWriteModel, err := c.getSecretConfig(ctx, generatorType)
 	if err != nil {
diff --git a/internal/command/instance_settings_test.go b/internal/command/instance_settings_test.go
index b52db33fc..e18310377 100644
--- a/internal/command/instance_settings_test.go
+++ b/internal/command/instance_settings_test.go
@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -218,6 +219,52 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "secret generator config invalid (length), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              0,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: true,
+					IncludeUpperLetters: true,
+					IncludeDigits:       true,
+					IncludeSymbols:      true,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument"))
+				},
+			},
+		},
+		{
+			name: "secret generator config invalid (charset), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              8,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: false,
+					IncludeUpperLetters: false,
+					IncludeDigits:       false,
+					IncludeSymbols:      false,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument"))
+				},
+			},
+		},
 		{
 			name: "generator removed, new added ok",
 			fields: fields{
@@ -332,15 +379,21 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						),
 					),
 					expectPush(
-						newSecretGeneratorChangedEvent(context.Background(),
-							domain.SecretGeneratorTypeInitCode,
-							8,
-							time.Hour*2,
-							false,
-							false,
-							false,
-							false,
-						),
+						func() *instance.SecretGeneratorChangedEvent {
+							changes := []instance.SecretGeneratorChanges{
+								instance.ChangeSecretGeneratorLength(8),
+								instance.ChangeSecretGeneratorExpiry(2 * time.Hour),
+								instance.ChangeSecretGeneratorIncludeUpperLetters(false),
+								instance.ChangeSecretGeneratorIncludeDigits(false),
+								instance.ChangeSecretGeneratorIncludeSymbols(false),
+							}
+							event, _ := instance.NewSecretGeneratorChangeEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								domain.SecretGeneratorTypeInitCode,
+								changes,
+							)
+							return event
+						}(),
 					),
 				),
 			},
@@ -349,7 +402,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				generator: &crypto.GeneratorConfig{
 					Length:              8,
 					Expiry:              2 * time.Hour,
-					IncludeLowerLetters: false,
+					IncludeLowerLetters: true,
 					IncludeUpperLetters: false,
 					IncludeDigits:       false,
 					IncludeSymbols:      false,
@@ -523,20 +576,3 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 		})
 	}
 }
-
-func newSecretGeneratorChangedEvent(ctx context.Context, generatorType domain.SecretGeneratorType, length uint, expiry time.Duration, lowerCase, upperCase, digits, symbols bool) *instance.SecretGeneratorChangedEvent {
-	changes := []instance.SecretGeneratorChanges{
-		instance.ChangeSecretGeneratorLength(length),
-		instance.ChangeSecretGeneratorExpiry(expiry),
-		instance.ChangeSecretGeneratorIncludeLowerLetters(lowerCase),
-		instance.ChangeSecretGeneratorIncludeUpperLetters(upperCase),
-		instance.ChangeSecretGeneratorIncludeDigits(digits),
-		instance.ChangeSecretGeneratorIncludeSymbols(symbols),
-	}
-	event, _ := instance.NewSecretGeneratorChangeEvent(ctx,
-		&instance.NewAggregate("INSTANCE").Aggregate,
-		generatorType,
-		changes,
-	)
-	return event
-}
diff --git a/internal/command/instance_test.go b/internal/command/instance_test.go
index b22f995f7..b564f3c02 100644
--- a/internal/command/instance_test.go
+++ b/internal/command/instance_test.go
@@ -331,6 +331,7 @@ func instanceElementsFilters() []expect {
 		expectFilter(),
 		expectFilter(),
 		expectFilter(),
+		expectFilter(),
 	}
 }
 
@@ -348,6 +349,7 @@ func instanceElementsEvents(ctx context.Context, instanceID, instanceName string
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false),
+		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInviteCode, 6, 72*time.Hour, false, true, true, false),
 	}
 }
 
@@ -362,6 +364,7 @@ func instanceElementsConfig() *SecretGenerators {
 		DomainVerification:       &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
 		OTPSMS:                   &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
 		OTPEmail:                 &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
+		InviteCode:               &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
 	}
 }
 
diff --git a/internal/crypto/code.go b/internal/crypto/code.go
index 34123e790..96f1bba3a 100644
--- a/internal/crypto/code.go
+++ b/internal/crypto/code.go
@@ -23,6 +23,16 @@ type GeneratorConfig struct {
 	IncludeSymbols      bool
 }
 
+func (c *GeneratorConfig) Valid() error {
+	if c.Length < 1 {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument")
+	}
+	if !c.IncludeLowerLetters && !c.IncludeUpperLetters && !c.IncludeDigits && !c.IncludeSymbols {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument")
+	}
+	return nil
+}
+
 //go:generate mockgen -source code.go -destination ./code_mock.go -package crypto
 
 type Generator interface {
diff --git a/internal/query/projection/settings_relational.go b/internal/query/projection/settings_relational.go
index 3838f12d8..757d875be 100644
--- a/internal/query/projection/settings_relational.go
+++ b/internal/query/projection/settings_relational.go
@@ -1584,8 +1584,12 @@ func setSecretGeneratorSettingsAttrs(generatorType legacy_domain.SecretGenerator
 		secretGeneratorSettingsAttrs.OTPEmail = &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
 		}
-	case legacy_domain.SecretGeneratorTypeInviteCode, legacy_domain.SecretGeneratorTypeSigningKey:
-		// do nothing as these secret generators are not persisted in the settings
+	case legacy_domain.SecretGeneratorTypeInviteCode:
+		secretGeneratorSettingsAttrs.InviteCode = &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
+		}
+	case legacy_domain.SecretGeneratorTypeSigningKey:
+		// do nothing as this secret generator is not persisted in the settings
 	case legacy_domain.SecretGeneratorTypeUnspecified:
 		return domain.SecretGeneratorSettingsAttributes{}, zerrors.ThrowInvalidArgumentf(nil, "HANDL-2n3fK", "unspecified secret generator type")
 	default:
diff --git a/internal/query/query.go b/internal/query/query.go
index da539442c..73f2ddd45 100644
--- a/internal/query/query.go
+++ b/internal/query/query.go
@@ -45,6 +45,7 @@ type Queries struct {
 	zitadelRoles                        []authz.RoleMapping
 	multifactors                        domain.MultifactorConfigs
 	defaultAuditLogRetention            time.Duration
+	defaultSecretGenerators             map[domain.SecretGeneratorType]*crypto.GeneratorConfig
 }
 
 func StartQueries(
@@ -62,6 +63,7 @@ func StartQueries(
 	defaultAuditLogRetention time.Duration,
 	systemAPIUsers map[string]*authz.SystemAPIUser,
 	startProjections bool,
+	secretGeneratorDefaults map[domain.SecretGeneratorType]*crypto.GeneratorConfig,
 ) (repo *Queries, err error) {
 	repo = &Queries{
 		eventstore:                          es,
@@ -84,6 +86,7 @@ func StartQueries(
 			},
 		},
 		defaultAuditLogRetention: defaultAuditLogRetention,
+		defaultSecretGenerators:  secretGeneratorDefaults,
 	}
 
 	repo.checkPermission = permissionCheck(repo)
diff --git a/internal/query/secret_generator_test.go b/internal/query/secret_generator_test.go
index 9ce8e7176..859841dd9 100644
--- a/internal/query/secret_generator_test.go
+++ b/internal/query/secret_generator_test.go
@@ -9,6 +9,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )
@@ -70,6 +76,9 @@ var (
 		"include_symbols",
 		"count",
 	}
+	expectedSecretGeneratorByTypeQuery = regexp.QuoteMeta(prepareSecretGeneratorStmt +
+		` WHERE projections.secret_generators2.generator_type = $1 AND projections.secret_generators2.instance_id = $2`)
+	secretGeneratorByTypeInstanceID = "instanceID"
 )
 
 func Test_SecretGeneratorsPrepares(t *testing.T) {
@@ -314,3 +323,101 @@ func Test_SecretGeneratorsPrepares(t *testing.T) {
 		})
 	}
 }
+
+func TestQueries_SecretGeneratorByType(t *testing.T) {
+	ctx := authz.NewMockContext(secretGeneratorByTypeInstanceID, "orgID", "loginClient")
+	generatorType := domain.SecretGeneratorTypeInviteCode
+	queryArgs := []driver.Value{generatorType, secretGeneratorByTypeInstanceID}
+	inviteCodeDefault := &crypto.GeneratorConfig{
+		Length:              6,
+		Expiry:              72 * time.Hour,
+		IncludeUpperLetters: true,
+		IncludeDigits:       true,
+	}
+
+	tests := []struct {
+		name                    string
+		mock                    sqlExpectation
+		defaultSecretGenerators map[domain.SecretGeneratorType]*crypto.GeneratorConfig
+		want                    *SecretGenerator
+		wantErr                 error
+	}{
+		{
+			name: "found in DB",
+			mock: mockQuery(expectedSecretGeneratorByTypeQuery, prepareSecretGeneratorCols, []driver.Value{
+				"agg-id",
+				domain.SecretGeneratorTypeInviteCode,
+				testNow,
+				testNow,
+				"ro",
+				uint64(20211108),
+				6,
+				72 * time.Hour,
+				false,
+				true,
+				true,
+				false,
+			}, queryArgs...),
+			want: &SecretGenerator{
+				AggregateID:         "agg-id",
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				CreationDate:        testNow,
+				ChangeDate:          testNow,
+				ResourceOwner:       "ro",
+				Sequence:            20211108,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeLowerLetters: false,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+				IncludeSymbols:      false,
+			},
+		},
+		{
+			name: "not found, default exists",
+			mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+				domain.SecretGeneratorTypeInviteCode: inviteCodeDefault,
+			},
+			want: &SecretGenerator{
+				AggregateID:         secretGeneratorByTypeInstanceID,
+				ResourceOwner:       secretGeneratorByTypeInstanceID,
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+			},
+		},
+		{
+			name:                    "not found, no default",
+			mock:                    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{},
+			wantErr:                 sql.ErrNoRows,
+		},
+		{
+			name:    "DB internal error",
+			mock:    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrConnDone, queryArgs...),
+			wantErr: sql.ErrConnDone,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			execMock(t, tt.mock, func(db *sql.DB) {
+				q := &Queries{
+					client: &database.DB{
+						DB: db,
+					},
+					defaultSecretGenerators: tt.defaultSecretGenerators,
+				}
+				got, err := q.SecretGeneratorByType(ctx, generatorType)
+				if tt.wantErr != nil {
+					require.ErrorIs(t, err, tt.wantErr)
+				} else {
+					require.NoError(t, err)
+				}
+				assert.Equal(t, tt.want, got)
+			})
+		})
+	}
+}
diff --git a/internal/query/secret_generators.go b/internal/query/secret_generators.go
index ca77bc35b..1809f1d12 100644
--- a/internal/query/secret_generators.go
+++ b/internal/query/secret_generators.go
@@ -139,8 +139,29 @@ func (q *Queries) SecretGeneratorByType(ctx context.Context, generatorType domai
 		generator, err = scan(row)
 		return err
 	}, query, args...)
-	logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
-	return generator, err
+	if err == nil {
+		return generator, nil
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
+		return nil, err
+	}
+	// if the config was not (yet) stored on the database, fall back to the system / runtime config
+	defaultConfig, ok := q.defaultSecretGenerators[generatorType]
+	if !ok {
+		return nil, err // return the initial not found error
+	}
+	return &SecretGenerator{
+		AggregateID:         instanceID,
+		ResourceOwner:       instanceID,
+		GeneratorType:       generatorType,
+		Length:              defaultConfig.Length,
+		Expiry:              defaultConfig.Expiry,
+		IncludeLowerLetters: defaultConfig.IncludeLowerLetters,
+		IncludeUpperLetters: defaultConfig.IncludeUpperLetters,
+		IncludeDigits:       defaultConfig.IncludeDigits,
+		IncludeSymbols:      defaultConfig.IncludeSymbols,
+	}, nil
 }
 
 func (q *Queries) SearchSecretGenerators(ctx context.Context, queries *SecretGeneratorSearchQueries) (secretGenerators *SecretGenerators, err error) {
diff --git a/proto/zitadel/settings.proto b/proto/zitadel/settings.proto
index 68d7ac1af..cdb4533d1 100644
--- a/proto/zitadel/settings.proto
+++ b/proto/zitadel/settings.proto
@@ -56,6 +56,7 @@ enum SecretGeneratorType {
   SECRET_GENERATOR_TYPE_APP_SECRET = 6;
   SECRET_GENERATOR_TYPE_OTP_SMS = 7;
   SECRET_GENERATOR_TYPE_OTP_EMAIL = 8;
+  SECRET_GENERATOR_TYPE_INVITE_CODE = 9;
 }
 
 message SMTPConfig {