From 1e0b810dca507da344441d2398e823f3c0a68547 Mon Sep 17 00:00:00 2001
From: Livio Spring <9405495+livio-a@users.noreply.github.com>
Date: Wed, 1 Jul 2026 06:53:16 +0200
Subject: [PATCH] feat: allow managing invite code in secret generators
 (#12109)

# Which Problems Are Solved

Zitadel exposes the secrets generator configuration through its admin
api. This allows instance admins to manage them on their own and they
can create overwrite the system / runtime defaults (incl. expiration).
This very much needed in multi-instance scenarios such as zitadel.cloud.
Currently the invite code configuration was not manageable through the
API, but only runtime config.

# How the Problems Are Solved

- added the `invite_code` type to the API allowing it to be set and
retrieved.
- added the type to console's management list
- added the type to be stored on instance setup
- change the `GetSecretGenerator` endpoint to fall back to the runtime
config if no config is stored on the instance itself
- ensure the `length` and at least one charset is enabled, return an
error otherwise
- expiry is not enforced, so 0 allows codes with no expiry (current
state)

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10474
---
 TERMINOLOGY.md                                |   1 +
 .../manage/console/default-settings.mdx       |   1 +
 backend/v3/domain/settings.go                 |   5 +
 .../events_testing/settings_instance_test.go  |   8 ++
 .../storage/database/repository/settings.go   |   7 ++
 .../database/repository/settings_test.go      |  32 ++++++
 cmd/defaults.yaml                             |  12 +-
 cmd/mirror/projections.go                     |   1 +
 cmd/setup/setup.go                            |   1 +
 cmd/start/start.go                            |   1 +
 .../secret-generator.component.ts             |   1 +
 console/src/assets/i18n/ar.json               |   3 +-
 console/src/assets/i18n/bg.json               |   3 +-
 console/src/assets/i18n/cs.json               |   3 +-
 console/src/assets/i18n/de.json               |   3 +-
 console/src/assets/i18n/en.json               |   3 +-
 console/src/assets/i18n/es.json               |   3 +-
 console/src/assets/i18n/fr.json               |   3 +-
 console/src/assets/i18n/hu.json               |   3 +-
 console/src/assets/i18n/id.json               |   3 +-
 console/src/assets/i18n/it.json               |   3 +-
 console/src/assets/i18n/ja.json               |   3 +-
 console/src/assets/i18n/ko.json               |   3 +-
 console/src/assets/i18n/mk.json               |   3 +-
 console/src/assets/i18n/nl.json               |   3 +-
 console/src/assets/i18n/pl.json               |   3 +-
 console/src/assets/i18n/pt.json               |   3 +-
 console/src/assets/i18n/ro.json               |   3 +-
 console/src/assets/i18n/ru.json               |   3 +-
 console/src/assets/i18n/sv.json               |   3 +-
 console/src/assets/i18n/tr.json               |   3 +-
 console/src/assets/i18n/uk.json               |   3 +-
 console/src/assets/i18n/zh.json               |   3 +-
 .../api/grpc/admin/iam_settings_converter.go  |   4 +
 internal/command/instance.go                  |  17 +++
 internal/command/instance_settings.go         |   9 +-
 internal/command/instance_settings_test.go    |  90 ++++++++++-----
 internal/command/instance_test.go             |   3 +
 internal/crypto/code.go                       |  10 ++
 .../query/projection/settings_relational.go   |   8 +-
 internal/query/query.go                       |   3 +
 internal/query/secret_generator_test.go       | 107 ++++++++++++++++++
 internal/query/secret_generators.go           |  25 +++-
 proto/zitadel/settings.proto                  |   1 +
 44 files changed, 351 insertions(+), 62 deletions(-)

diff --git a/TERMINOLOGY.md b/TERMINOLOGY.md
index 25760925e..23422aa7e 100644
--- a/TERMINOLOGY.md
+++ b/TERMINOLOGY.md
@@ -73,6 +73,7 @@ All user-facing wording in docs, UI, and API descriptions must follow this table
 | Password changed | Past-tense wording for password change notification | Password change | Password changed | replace | UI notifications |
 | Object descriptions | All resource descriptions must use end-user language | internal / technical wording | clear end-user language | replace | UI + Docs |
 | Complement Token | Flow type for actions executed during token creation. In UI use "Complement Token"; in API use `flowType = 2` (CustomiseToken). Docs must not show PreUserinfoCreation=3 for this type. | Compliment Token, CustomiseToken, CustomizeToken | Complement Token | replace | Everywhere |
+| Invite Code | One-time code used to invite a user to set up authentication (secret generator and user-invite flows) | Invitation Code, Invitation code | Invite Code | replace | UI + Docs |
 
 ## Governance
 
diff --git a/apps/docs/content/guides/manage/console/default-settings.mdx b/apps/docs/content/guides/manage/console/default-settings.mdx
index afeb1c887..10de697e9 100644
--- a/apps/docs/content/guides/manage/console/default-settings.mdx
+++ b/apps/docs/content/guides/manage/console/default-settings.mdx
@@ -387,6 +387,7 @@ The following secrets can be specified:
 - Application secrets
 - One Time Password (OTP) - SMS
 - One Time Password (OTP) - Email
+- Invite Code
 
 <img
   src="/docs/img/guides/console/secretappearance.png"
diff --git a/backend/v3/domain/settings.go b/backend/v3/domain/settings.go
index b84279232..1691b725d 100644
--- a/backend/v3/domain/settings.go
+++ b/backend/v3/domain/settings.go
@@ -476,6 +476,7 @@ type SecretGeneratorSettingsAttributes struct {
 	DomainVerification       *DomainVerificationAttributes       `json:"domainVerification,omitempty"`
 	OTPSMS                   *OTPSMSAttributes                   `json:"otpSms,omitempty"`
 	OTPEmail                 *OTPEmailAttributes                 `json:"otpEmail,omitempty"`
+	InviteCode               *InviteCodeAttributes               `json:"inviteCode,omitempty"`
 }
 
 type ClientSecretAttributes struct {
@@ -514,6 +515,10 @@ type OTPEmailAttributes struct {
 	SecretGeneratorAttrsWithExpiry
 }
 
+type InviteCodeAttributes struct {
+	SecretGeneratorAttrsWithExpiry
+}
+
 type SecretGeneratorAttrs struct {
 	Length              *uint `json:"length,omitempty"`
 	IncludeLowerLetters *bool `json:"includeLowerLetters,omitempty"`
diff --git a/backend/v3/storage/database/events_testing/settings_instance_test.go b/backend/v3/storage/database/events_testing/settings_instance_test.go
index 474d577d5..7fade369e 100644
--- a/backend/v3/storage/database/events_testing/settings_instance_test.go
+++ b/backend/v3/storage/database/events_testing/settings_instance_test.go
@@ -1477,6 +1477,14 @@ func TestServer_TestInstanceSecretGeneratorSettingsReduces(t *testing.T) {
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeUpperLetters)
 			assert.Equal(collect, true, *setting.OTPEmail.IncludeDigits)
 			assert.Equal(collect, false, *setting.OTPEmail.IncludeSymbols)
+
+			// InviteCode
+			assert.Equal(collect, uint(6), *setting.InviteCode.Length)
+			assert.Equal(collect, 72*time.Hour, *setting.InviteCode.Expiry)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeLowerLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeUpperLetters)
+			assert.Equal(collect, true, *setting.InviteCode.IncludeDigits)
+			assert.Equal(collect, false, *setting.InviteCode.IncludeSymbols)
 		}, retryDuration, tick)
 	})
 
diff --git a/backend/v3/storage/database/repository/settings.go b/backend/v3/storage/database/repository/settings.go
index 326cf8f70..29187c746 100644
--- a/backend/v3/storage/database/repository/settings.go
+++ b/backend/v3/storage/database/repository/settings.go
@@ -1456,6 +1456,9 @@ func (s secretGeneratorSettings) SetSettingFields(value domain.SecretGeneratorSe
 	if value.OTPEmail != nil {
 		changes = append(changes, s.SetOTPEmail(*value.OTPEmail))
 	}
+	if value.InviteCode != nil {
+		changes = append(changes, s.SetInviteCode(*value.InviteCode))
+	}
 	return db_json.NewJsonChanges(s.SettingsColumn(), changes...)
 }
 
@@ -1495,6 +1498,10 @@ func (s secretGeneratorSettings) SetOTPEmail(value domain.OTPEmailAttributes) db
 	return db_json.NewFieldChange([]string{"otpEmail"}, value)
 }
 
+func (s secretGeneratorSettings) SetInviteCode(value domain.InviteCodeAttributes) db_json.JsonUpdate {
+	return db_json.NewFieldChange([]string{"inviteCode"}, value)
+}
+
 func SecretGeneratorSettingsRepository() domain.SecretGeneratorSettingsRepository {
 	return &secretGeneratorSettings{
 		settings{},
diff --git a/backend/v3/storage/database/repository/settings_test.go b/backend/v3/storage/database/repository/settings_test.go
index 39c724445..3b3b0813b 100644
--- a/backend/v3/storage/database/repository/settings_test.go
+++ b/backend/v3/storage/database/repository/settings_test.go
@@ -5134,6 +5134,9 @@ func createDefaultSecretGeneratorSettingsAttributes() domain.SecretGeneratorSett
 		OTPEmail: &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(thirtyMinutes),
 		},
+		InviteCode: &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(oneDay * 3),
+		},
 	}
 }
 
@@ -5146,3 +5149,32 @@ func createSecretGeneratorSettings(instanceID string, organizationID *string) *d
 		SecretGeneratorSettingsAttributes: createDefaultSecretGeneratorSettingsAttributes(),
 	}
 }
+
+func TestSecretGeneratorSettingsInviteCodeRoundTrip(t *testing.T) {
+	tx, rollback := transactionForRollback(t)
+	defer rollback()
+
+	instanceID := createInstance(t, tx)
+	repo := repository.SecretGeneratorSettingsRepository()
+
+	want := createSecretGeneratorSettings(instanceID, nil)
+	require.NotNil(t, want.InviteCode)
+
+	err := repo.Set(t.Context(), tx, want)
+	require.NoError(t, err)
+
+	got, err := repo.Get(t.Context(), tx, database.WithCondition(
+		repo.UniqueCondition(instanceID, nil, domain.SettingTypeSecretGenerator, domain.SettingStateActive),
+	))
+	require.NoError(t, err)
+	require.NotNil(t, got.InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, got.InviteCode)
+
+	list, err := repo.List(t.Context(), tx, database.WithCondition(
+		repo.InstanceIDCondition(instanceID),
+	))
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.NotNil(t, list[0].InviteCode)
+	assert.EqualExportedValues(t, want.InviteCode, list[0].InviteCode)
+}
diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml
index 79b99b557..d7b151ce9 100644
--- a/cmd/defaults.yaml
+++ b/cmd/defaults.yaml
@@ -1212,12 +1212,12 @@ DefaultInstance:
       IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDEDIGITS
       IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDESYMBOLS
     InviteCode:
-      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_LENGTH
-      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_EXPIRY
-      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDELOWERLETTERS
-      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEUPPERLETTERS
-      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEDIGITS
-      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDESYMBOLS
+      Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_LENGTH
+      Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_EXPIRY
+      IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDELOWERLETTERS
+      IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEUPPERLETTERS
+      IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEDIGITS
+      IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDESYMBOLS
     SigningKey:
       Length: 36 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_LENGTH
       IncludeLowerLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_INCLUDELOWERLETTERS
diff --git a/cmd/mirror/projections.go b/cmd/mirror/projections.go
index e3df16b57..ac15dc697 100644
--- a/cmd/mirror/projections.go
+++ b/cmd/mirror/projections.go
@@ -177,6 +177,7 @@ func projections(
 		0,
 		config.SystemAPIUsers,
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 
diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go
index 2992bc044..c031df36b 100644
--- a/cmd/setup/setup.go
+++ b/cmd/setup/setup.go
@@ -535,6 +535,7 @@ func startCommandsQueries(
 		0,   // not needed for projections
 		nil, // not needed for projections
 		false,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	logging.OnError(ctx, err).Fatal("unable to start queries")
 
diff --git a/cmd/start/start.go b/cmd/start/start.go
index 80b719d04..19e520fec 100644
--- a/cmd/start/start.go
+++ b/cmd/start/start.go
@@ -248,6 +248,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
 		config.AuditLogRetention,
 		config.SystemAPIUsers,
 		true,
+		config.DefaultInstance.SecretGenerators.ToMap(),
 	)
 	if err != nil {
 		return fmt.Errorf("cannot start queries: %w", err)
diff --git a/console/src/app/modules/policies/secret-generator/secret-generator.component.ts b/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
index 1f4867c8a..d3d4aa4ab 100644
--- a/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
+++ b/console/src/app/modules/policies/secret-generator/secret-generator.component.ts
@@ -19,6 +19,7 @@ export class SecretGeneratorComponent {
     SecretGeneratorType.SECRET_GENERATOR_TYPE_APP_SECRET,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_SMS,
     SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_EMAIL,
+    SecretGeneratorType.SECRET_GENERATOR_TYPE_INVITE_CODE,
   ];
 
   constructor() {}
diff --git a/console/src/assets/i18n/ar.json b/console/src/assets/i18n/ar.json
index 9220bc703..f43fe3632 100644
--- a/console/src/assets/i18n/ar.json
+++ b/console/src/assets/i18n/ar.json
@@ -1608,7 +1608,8 @@
         "5": "تهيئة بدون كلمة مرور",
         "6": "سر التطبيق",
         "7": "OTP - SMS",
-        "8": "OTP - بريد إلكتروني"
+        "8": "OTP - بريد إلكتروني",
+        "9": "رمز الدعوة"
       },
       "EXPIRY": "انتهاء الصلاحية (بالدقائق)",
       "INCLUDEDIGITS": "تضمين أرقام",
diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json
index c3450823e..438f856a8 100644
--- a/console/src/assets/i18n/bg.json
+++ b/console/src/assets/i18n/bg.json
@@ -1615,7 +1615,8 @@
         "5": "Инициализация на ключ за достъп",
         "6": "Тайна на приложението",
         "7": "OTP - SMS",
-        "8": "OTP – имейл"
+        "8": "OTP – имейл",
+        "9": "Код за покана"
       },
       "EXPIRY": "Изтичане (в минути)",
       "INCLUDEDIGITS": "Включете числа",
diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json
index 7df3432d0..1211d7386 100644
--- a/console/src/assets/i18n/cs.json
+++ b/console/src/assets/i18n/cs.json
@@ -1613,7 +1613,8 @@
         "5": "Inicializace Passkey",
         "6": "Tajemství pomocí aplikace",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Kód pozvánky"
       },
       "EXPIRY": "Expirace (v minutách)",
       "INCLUDEDIGITS": "Zahrnout čísla",
diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json
index 5aa83ee40..bee10fa67 100644
--- a/console/src/assets/i18n/de.json
+++ b/console/src/assets/i18n/de.json
@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisierungscode",
         "6": "Anwendungsgeheimnis",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Einladungscode"
       },
       "EXPIRY": "Ablauf (in Minuten)",
       "INCLUDEDIGITS": "Enthält Zahlen",
diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json
index c86694ae0..6919ca40a 100644
--- a/console/src/assets/i18n/en.json
+++ b/console/src/assets/i18n/en.json
@@ -1618,7 +1618,8 @@
         "5": "Passkey Initialization",
         "6": "Application Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Invite Code"
       },
       "EXPIRY": "Expiration (in minutes)",
       "INCLUDEDIGITS": "Include Numbers",
diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json
index ddaaf065d..8068c4df9 100644
--- a/console/src/assets/i18n/es.json
+++ b/console/src/assets/i18n/es.json
@@ -1614,7 +1614,8 @@
         "5": "Inicialización de llave de acceso",
         "6": "Secreto de aplicación",
         "7": "One Time Password (OTP) - SMS",
-        "8": "One Time Password (OTP) - email"
+        "8": "One Time Password (OTP) - email",
+        "9": "Código de invitación"
       },
       "EXPIRY": "Caducidad (en minutos)",
       "INCLUDEDIGITS": "Incluir números",
diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json
index 4d7b2364c..759890071 100644
--- a/console/src/assets/i18n/fr.json
+++ b/console/src/assets/i18n/fr.json
@@ -1613,7 +1613,8 @@
         "5": "Initialisation de clé d'accès",
         "6": "Secret de l'application",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Code d'invitation"
       },
       "EXPIRY": "Expiration (en minutes)",
       "INCLUDEDIGITS": "Inclure les chiffres",
diff --git a/console/src/assets/i18n/hu.json b/console/src/assets/i18n/hu.json
index 91703e5d0..5ac10e109 100644
--- a/console/src/assets/i18n/hu.json
+++ b/console/src/assets/i18n/hu.json
@@ -1611,7 +1611,8 @@
         "5": "Passkey inicializálás",
         "6": "Alkalmazás titok",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Meghívókód"
       },
       "EXPIRY": "Lejárat (percben)",
       "INCLUDEDIGITS": "Számok bevonása",
diff --git a/console/src/assets/i18n/id.json b/console/src/assets/i18n/id.json
index e8ce1915d..a09066f8b 100644
--- a/console/src/assets/i18n/id.json
+++ b/console/src/assets/i18n/id.json
@@ -1613,7 +1613,8 @@
         "5": "Inisialisasi Passkey",
         "6": "Rahasia Aplikasi",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Kode Undangan"
       },
       "EXPIRY": "Kedaluwarsa (dalam menit)",
       "INCLUDEDIGITS": "Sertakan Angka",
diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json
index 1b95b8527..e26b69029 100644
--- a/console/src/assets/i18n/it.json
+++ b/console/src/assets/i18n/it.json
@@ -1613,7 +1613,8 @@
         "5": "Inizializzazione passkey",
         "6": "Segreto dell'applicazione",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Codice di invito"
       },
       "EXPIRY": "Scadenza (in minuti)",
       "INCLUDEDIGITS": "Contiene numeri",
diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json
index c2e125c91..d1ee46c57 100644
--- a/console/src/assets/i18n/ja.json
+++ b/console/src/assets/i18n/ja.json
@@ -1613,7 +1613,8 @@
         "5": "パスキーの初期設定",
         "6": "アプリケーションのシークレット",
         "7": "OTP - SMS",
-        "8": "OTP - 電子メール"
+        "8": "OTP - 電子メール",
+        "9": "招待コード"
       },
       "EXPIRY": "有効期限 (分単位)",
       "INCLUDEDIGITS": "数字を含める",
diff --git a/console/src/assets/i18n/ko.json b/console/src/assets/i18n/ko.json
index d68cc73b8..d4ea7e626 100644
--- a/console/src/assets/i18n/ko.json
+++ b/console/src/assets/i18n/ko.json
@@ -1613,7 +1613,8 @@
         "5": "패스키 초기화",
         "6": "애플리케이션 시크릿",
         "7": "OTP - SMS",
-        "8": "OTP - 이메일"
+        "8": "OTP - 이메일",
+        "9": "초대 코드"
       },
       "EXPIRY": "만료 시간 (분)",
       "INCLUDEDIGITS": "숫자 포함",
diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json
index 0b9905255..935267c99 100644
--- a/console/src/assets/i18n/mk.json
+++ b/console/src/assets/i18n/mk.json
@@ -1614,7 +1614,8 @@
         "5": "Иницијализација на Passkey",
         "6": "Апликациска тајна",
         "7": "OTP - СМС",
-        "8": "OTP - е-пошта"
+        "8": "OTP - е-пошта",
+        "9": "Код за покана"
       },
       "EXPIRY": "Истекување (во минути)",
       "INCLUDEDIGITS": "Вклучи цифри",
diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json
index b2d70ffaf..fd830587a 100644
--- a/console/src/assets/i18n/nl.json
+++ b/console/src/assets/i18n/nl.json
@@ -1613,7 +1613,8 @@
         "5": "Passkey Initialisatie",
         "6": "Applicatie Secret",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Uitnodigingscode"
       },
       "EXPIRY": "Vervaldatum (in minuten)",
       "INCLUDEDIGITS": "Inclusief Nummers",
diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json
index 888b48128..30c8bd798 100644
--- a/console/src/assets/i18n/pl.json
+++ b/console/src/assets/i18n/pl.json
@@ -1612,7 +1612,8 @@
         "5": "Inicjalizacja passkey",
         "6": "Sekret aplikacji",
         "7": "OTP - SMS",
-        "8": "OTP — e-mail"
+        "8": "OTP — e-mail",
+        "9": "Kod zaproszenia"
       },
       "EXPIRY": "Wygaśnięcie (w minutach)",
       "INCLUDEDIGITS": "Dołącz cyfry",
diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json
index 571d459e8..fbb82161c 100644
--- a/console/src/assets/i18n/pt.json
+++ b/console/src/assets/i18n/pt.json
@@ -1614,7 +1614,8 @@
         "5": "Inicialização passkey",
         "6": "Segredo do aplicativo",
         "7": "OTP - SMS",
-        "8": "OTP - e-mail"
+        "8": "OTP - e-mail",
+        "9": "Código de convite"
       },
       "EXPIRY": "Expiração (em minutos)",
       "INCLUDEDIGITS": "Incluir números",
diff --git a/console/src/assets/i18n/ro.json b/console/src/assets/i18n/ro.json
index 336709014..0a4d7e764 100644
--- a/console/src/assets/i18n/ro.json
+++ b/console/src/assets/i18n/ro.json
@@ -1611,7 +1611,8 @@
         "5": "Inițializarea Passkey",
         "6": "Secretul aplicației",
         "7": "OTP - SMS",
-        "8": "OTP - E-mail"
+        "8": "OTP - E-mail",
+        "9": "Cod de invitație"
       },
       "EXPIRY": "Expirare (în minute)",
       "INCLUDEDIGITS": "Includeți numere",
diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json
index 8cbbcc8cf..ee6eaf976 100644
--- a/console/src/assets/i18n/ru.json
+++ b/console/src/assets/i18n/ru.json
@@ -1672,7 +1672,8 @@
         "5": "Инициализация ключа доступа",
         "6": "Ключ приложения",
         "7": "OTP — SMS",
-        "8": "OTP – электронная почта"
+        "8": "OTP – электронная почта",
+        "9": "Код приглашения"
       },
       "EXPIRY": "Срок действия (в минутах)",
       "INCLUDEDIGITS": "Содержит цифры",
diff --git a/console/src/assets/i18n/sv.json b/console/src/assets/i18n/sv.json
index d4b41b439..515382478 100644
--- a/console/src/assets/i18n/sv.json
+++ b/console/src/assets/i18n/sv.json
@@ -1617,7 +1617,8 @@
         "5": "Passkey-initiering",
         "6": "Applikations-hemlighet",
         "7": "OTP - SMS",
-        "8": "OTP - E-post"
+        "8": "OTP - E-post",
+        "9": "Inbjudningskod"
       },
       "EXPIRY": "Utgång (på minuter)",
       "INCLUDEDIGITS": "Inkludera siffror",
diff --git a/console/src/assets/i18n/tr.json b/console/src/assets/i18n/tr.json
index 446607971..7ffe7f66c 100644
--- a/console/src/assets/i18n/tr.json
+++ b/console/src/assets/i18n/tr.json
@@ -1616,7 +1616,8 @@
         "5": "Passkey Başlatma",
         "6": "Uygulama Gizli Anahtarı",
         "7": "OTP - SMS",
-        "8": "OTP - E-posta"
+        "8": "OTP - E-posta",
+        "9": "Davet Kodu"
       },
       "EXPIRY": "Son kullanma (dakika cinsinden)",
       "INCLUDEDIGITS": "Sayıları Dahil Et",
diff --git a/console/src/assets/i18n/uk.json b/console/src/assets/i18n/uk.json
index 139c03795..5d93f7f65 100644
--- a/console/src/assets/i18n/uk.json
+++ b/console/src/assets/i18n/uk.json
@@ -1617,7 +1617,8 @@
         "5": "Ініціалізація ключа доступу",
         "6": "Секрет додатка",
         "7": "OTP - SMS",
-        "8": "OTP - Email"
+        "8": "OTP - Email",
+        "9": "Код запрошення"
       },
       "EXPIRY": "Термін дії (у хвилинах)",
       "INCLUDEDIGITS": "Включити цифри",
diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json
index 7f82f148a..6bea72d8e 100644
--- a/console/src/assets/i18n/zh.json
+++ b/console/src/assets/i18n/zh.json
@@ -1616,7 +1616,8 @@
         "5": "Passkey 初始化",
         "6": "应用密钥",
         "7": "OTP - SMS",
-        "8": "OTP - 电子邮件"
+        "8": "OTP - 电子邮件",
+        "9": "邀请码"
       },
       "EXPIRY": "过期时间 (以分钟为单位)",
       "INCLUDEDIGITS": "包含数字",
diff --git a/internal/api/grpc/admin/iam_settings_converter.go b/internal/api/grpc/admin/iam_settings_converter.go
index f3ce470a2..c306eb7db 100644
--- a/internal/api/grpc/admin/iam_settings_converter.go
+++ b/internal/api/grpc/admin/iam_settings_converter.go
@@ -105,6 +105,8 @@ func SecretGeneratorTypeToPb(generatorType domain.SecretGeneratorType) settings_
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_SMS
 	case domain.SecretGeneratorTypeOTPEmail:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL
+	case domain.SecretGeneratorTypeInviteCode:
+		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE
 	default:
 		return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_UNSPECIFIED
 	}
@@ -128,6 +130,8 @@ func SecretGeneratorTypeToDomain(generatorType settings_pb.SecretGeneratorType)
 		return domain.SecretGeneratorTypeOTPSMS
 	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL:
 		return domain.SecretGeneratorTypeOTPEmail
+	case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE:
+		return domain.SecretGeneratorTypeInviteCode
 	default:
 		return domain.SecretGeneratorTypeUnspecified
 	}
diff --git a/internal/command/instance.go b/internal/command/instance.go
index 63ff4731f..1b879f518 100644
--- a/internal/command/instance.go
+++ b/internal/command/instance.go
@@ -163,6 +163,22 @@ type SecretGenerators struct {
 	SigningKey               *crypto.GeneratorConfig
 }
 
+func (s *SecretGenerators) ToMap() map[domain.SecretGeneratorType]*crypto.GeneratorConfig {
+	return map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+		domain.SecretGeneratorTypeInitCode:             s.InitializeUserCode,
+		domain.SecretGeneratorTypeVerifyEmailCode:      s.EmailVerificationCode,
+		domain.SecretGeneratorTypeVerifyPhoneCode:      s.PhoneVerificationCode,
+		domain.SecretGeneratorTypeVerifyDomain:         s.DomainVerification,
+		domain.SecretGeneratorTypePasswordResetCode:    s.PasswordVerificationCode,
+		domain.SecretGeneratorTypePasswordlessInitCode: s.PasswordlessInitCode,
+		domain.SecretGeneratorTypeAppSecret:            s.ClientSecret,
+		domain.SecretGeneratorTypeOTPSMS:               s.OTPSMS,
+		domain.SecretGeneratorTypeOTPEmail:             s.OTPEmail,
+		domain.SecretGeneratorTypeInviteCode:           s.InviteCode,
+		domain.SecretGeneratorTypeSigningKey:           s.SigningKey,
+	}
+}
+
 type ZitadelConfig struct {
 	instanceID             string
 	orgID                  string
@@ -326,6 +342,7 @@ func setupInstanceElements(instanceAgg *instance.Aggregate, setup *InstanceSetup
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyDomain, setup.SecretGenerators.DomainVerification),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPSMS, setup.SecretGenerators.OTPSMS),
 		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPEmail, setup.SecretGenerators.OTPEmail),
+		prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInviteCode, setup.SecretGenerators.InviteCode),
 
 		prepareAddDefaultPasswordComplexityPolicy(
 			instanceAgg,
diff --git a/internal/command/instance_settings.go b/internal/command/instance_settings.go
index 93bbdc831..638c28d4a 100644
--- a/internal/command/instance_settings.go
+++ b/internal/command/instance_settings.go
@@ -35,8 +35,8 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 		if !typ.Valid() {
 			return nil, zerrors.ThrowInvalidArgument(nil, "V2-FGqVj", "Errors.InvalidArgument")
 		}
-		if config.Length < 1 {
-			return nil, zerrors.ThrowInvalidArgument(nil, "V2-jEqCt", "Errors.InvalidArgument")
+		if err := config.Valid(); err != nil {
+			return nil, err
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			writeModel := NewInstanceSecretGeneratorConfigWriteModel(ctx, typ)
@@ -71,9 +71,12 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
 }
 
 func (c *Commands) ChangeSecretGeneratorConfig(ctx context.Context, generatorType domain.SecretGeneratorType, config *crypto.GeneratorConfig) (*domain.ObjectDetails, error) {
-	if generatorType == domain.SecretGeneratorTypeUnspecified {
+	if !generatorType.Valid() {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-33k9f", "Errors.SecretGenerator.TypeMissing")
 	}
+	if err := config.Valid(); err != nil {
+		return nil, err
+	}
 
 	generatorWriteModel, err := c.getSecretConfig(ctx, generatorType)
 	if err != nil {
diff --git a/internal/command/instance_settings_test.go b/internal/command/instance_settings_test.go
index b52db33fc..e18310377 100644
--- a/internal/command/instance_settings_test.go
+++ b/internal/command/instance_settings_test.go
@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -218,6 +219,52 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "secret generator config invalid (length), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              0,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: true,
+					IncludeUpperLetters: true,
+					IncludeDigits:       true,
+					IncludeSymbols:      true,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument"))
+				},
+			},
+		},
+		{
+			name: "secret generator config invalid (charset), invalid error",
+			fields: fields{
+				eventstore: expectEventstore(),
+			},
+			args: args{
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
+				generator: &crypto.GeneratorConfig{
+					Length:              8,
+					Expiry:              2 * time.Hour,
+					IncludeLowerLetters: false,
+					IncludeUpperLetters: false,
+					IncludeDigits:       false,
+					IncludeSymbols:      false,
+				},
+				generatorType: domain.SecretGeneratorTypeInitCode,
+			},
+			res: res{
+				err: func(err error) bool {
+					return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument"))
+				},
+			},
+		},
 		{
 			name: "generator removed, new added ok",
 			fields: fields{
@@ -332,15 +379,21 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						),
 					),
 					expectPush(
-						newSecretGeneratorChangedEvent(context.Background(),
-							domain.SecretGeneratorTypeInitCode,
-							8,
-							time.Hour*2,
-							false,
-							false,
-							false,
-							false,
-						),
+						func() *instance.SecretGeneratorChangedEvent {
+							changes := []instance.SecretGeneratorChanges{
+								instance.ChangeSecretGeneratorLength(8),
+								instance.ChangeSecretGeneratorExpiry(2 * time.Hour),
+								instance.ChangeSecretGeneratorIncludeUpperLetters(false),
+								instance.ChangeSecretGeneratorIncludeDigits(false),
+								instance.ChangeSecretGeneratorIncludeSymbols(false),
+							}
+							event, _ := instance.NewSecretGeneratorChangeEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								domain.SecretGeneratorTypeInitCode,
+								changes,
+							)
+							return event
+						}(),
 					),
 				),
 			},
@@ -349,7 +402,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 				generator: &crypto.GeneratorConfig{
 					Length:              8,
 					Expiry:              2 * time.Hour,
-					IncludeLowerLetters: false,
+					IncludeLowerLetters: true,
 					IncludeUpperLetters: false,
 					IncludeDigits:       false,
 					IncludeSymbols:      false,
@@ -523,20 +576,3 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 		})
 	}
 }
-
-func newSecretGeneratorChangedEvent(ctx context.Context, generatorType domain.SecretGeneratorType, length uint, expiry time.Duration, lowerCase, upperCase, digits, symbols bool) *instance.SecretGeneratorChangedEvent {
-	changes := []instance.SecretGeneratorChanges{
-		instance.ChangeSecretGeneratorLength(length),
-		instance.ChangeSecretGeneratorExpiry(expiry),
-		instance.ChangeSecretGeneratorIncludeLowerLetters(lowerCase),
-		instance.ChangeSecretGeneratorIncludeUpperLetters(upperCase),
-		instance.ChangeSecretGeneratorIncludeDigits(digits),
-		instance.ChangeSecretGeneratorIncludeSymbols(symbols),
-	}
-	event, _ := instance.NewSecretGeneratorChangeEvent(ctx,
-		&instance.NewAggregate("INSTANCE").Aggregate,
-		generatorType,
-		changes,
-	)
-	return event
-}
diff --git a/internal/command/instance_test.go b/internal/command/instance_test.go
index b22f995f7..b564f3c02 100644
--- a/internal/command/instance_test.go
+++ b/internal/command/instance_test.go
@@ -331,6 +331,7 @@ func instanceElementsFilters() []expect {
 		expectFilter(),
 		expectFilter(),
 		expectFilter(),
+		expectFilter(),
 	}
 }
 
@@ -348,6 +349,7 @@ func instanceElementsEvents(ctx context.Context, instanceID, instanceName string
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false),
 		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false),
+		instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInviteCode, 6, 72*time.Hour, false, true, true, false),
 	}
 }
 
@@ -362,6 +364,7 @@ func instanceElementsConfig() *SecretGenerators {
 		DomainVerification:       &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
 		OTPSMS:                   &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
 		OTPEmail:                 &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
+		InviteCode:               &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
 	}
 }
 
diff --git a/internal/crypto/code.go b/internal/crypto/code.go
index 34123e790..96f1bba3a 100644
--- a/internal/crypto/code.go
+++ b/internal/crypto/code.go
@@ -23,6 +23,16 @@ type GeneratorConfig struct {
 	IncludeSymbols      bool
 }
 
+func (c *GeneratorConfig) Valid() error {
+	if c.Length < 1 {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument")
+	}
+	if !c.IncludeLowerLetters && !c.IncludeUpperLetters && !c.IncludeDigits && !c.IncludeSymbols {
+		return zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument")
+	}
+	return nil
+}
+
 //go:generate mockgen -source code.go -destination ./code_mock.go -package crypto
 
 type Generator interface {
diff --git a/internal/query/projection/settings_relational.go b/internal/query/projection/settings_relational.go
index 3838f12d8..757d875be 100644
--- a/internal/query/projection/settings_relational.go
+++ b/internal/query/projection/settings_relational.go
@@ -1584,8 +1584,12 @@ func setSecretGeneratorSettingsAttrs(generatorType legacy_domain.SecretGenerator
 		secretGeneratorSettingsAttrs.OTPEmail = &domain.OTPEmailAttributes{
 			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
 		}
-	case legacy_domain.SecretGeneratorTypeInviteCode, legacy_domain.SecretGeneratorTypeSigningKey:
-		// do nothing as these secret generators are not persisted in the settings
+	case legacy_domain.SecretGeneratorTypeInviteCode:
+		secretGeneratorSettingsAttrs.InviteCode = &domain.InviteCodeAttributes{
+			SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
+		}
+	case legacy_domain.SecretGeneratorTypeSigningKey:
+		// do nothing as this secret generator is not persisted in the settings
 	case legacy_domain.SecretGeneratorTypeUnspecified:
 		return domain.SecretGeneratorSettingsAttributes{}, zerrors.ThrowInvalidArgumentf(nil, "HANDL-2n3fK", "unspecified secret generator type")
 	default:
diff --git a/internal/query/query.go b/internal/query/query.go
index da539442c..73f2ddd45 100644
--- a/internal/query/query.go
+++ b/internal/query/query.go
@@ -45,6 +45,7 @@ type Queries struct {
 	zitadelRoles                        []authz.RoleMapping
 	multifactors                        domain.MultifactorConfigs
 	defaultAuditLogRetention            time.Duration
+	defaultSecretGenerators             map[domain.SecretGeneratorType]*crypto.GeneratorConfig
 }
 
 func StartQueries(
@@ -62,6 +63,7 @@ func StartQueries(
 	defaultAuditLogRetention time.Duration,
 	systemAPIUsers map[string]*authz.SystemAPIUser,
 	startProjections bool,
+	secretGeneratorDefaults map[domain.SecretGeneratorType]*crypto.GeneratorConfig,
 ) (repo *Queries, err error) {
 	repo = &Queries{
 		eventstore:                          es,
@@ -84,6 +86,7 @@ func StartQueries(
 			},
 		},
 		defaultAuditLogRetention: defaultAuditLogRetention,
+		defaultSecretGenerators:  secretGeneratorDefaults,
 	}
 
 	repo.checkPermission = permissionCheck(repo)
diff --git a/internal/query/secret_generator_test.go b/internal/query/secret_generator_test.go
index 9ce8e7176..859841dd9 100644
--- a/internal/query/secret_generator_test.go
+++ b/internal/query/secret_generator_test.go
@@ -9,6 +9,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )
@@ -70,6 +76,9 @@ var (
 		"include_symbols",
 		"count",
 	}
+	expectedSecretGeneratorByTypeQuery = regexp.QuoteMeta(prepareSecretGeneratorStmt +
+		` WHERE projections.secret_generators2.generator_type = $1 AND projections.secret_generators2.instance_id = $2`)
+	secretGeneratorByTypeInstanceID = "instanceID"
 )
 
 func Test_SecretGeneratorsPrepares(t *testing.T) {
@@ -314,3 +323,101 @@ func Test_SecretGeneratorsPrepares(t *testing.T) {
 		})
 	}
 }
+
+func TestQueries_SecretGeneratorByType(t *testing.T) {
+	ctx := authz.NewMockContext(secretGeneratorByTypeInstanceID, "orgID", "loginClient")
+	generatorType := domain.SecretGeneratorTypeInviteCode
+	queryArgs := []driver.Value{generatorType, secretGeneratorByTypeInstanceID}
+	inviteCodeDefault := &crypto.GeneratorConfig{
+		Length:              6,
+		Expiry:              72 * time.Hour,
+		IncludeUpperLetters: true,
+		IncludeDigits:       true,
+	}
+
+	tests := []struct {
+		name                    string
+		mock                    sqlExpectation
+		defaultSecretGenerators map[domain.SecretGeneratorType]*crypto.GeneratorConfig
+		want                    *SecretGenerator
+		wantErr                 error
+	}{
+		{
+			name: "found in DB",
+			mock: mockQuery(expectedSecretGeneratorByTypeQuery, prepareSecretGeneratorCols, []driver.Value{
+				"agg-id",
+				domain.SecretGeneratorTypeInviteCode,
+				testNow,
+				testNow,
+				"ro",
+				uint64(20211108),
+				6,
+				72 * time.Hour,
+				false,
+				true,
+				true,
+				false,
+			}, queryArgs...),
+			want: &SecretGenerator{
+				AggregateID:         "agg-id",
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				CreationDate:        testNow,
+				ChangeDate:          testNow,
+				ResourceOwner:       "ro",
+				Sequence:            20211108,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeLowerLetters: false,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+				IncludeSymbols:      false,
+			},
+		},
+		{
+			name: "not found, default exists",
+			mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
+				domain.SecretGeneratorTypeInviteCode: inviteCodeDefault,
+			},
+			want: &SecretGenerator{
+				AggregateID:         secretGeneratorByTypeInstanceID,
+				ResourceOwner:       secretGeneratorByTypeInstanceID,
+				GeneratorType:       domain.SecretGeneratorTypeInviteCode,
+				Length:              6,
+				Expiry:              72 * time.Hour,
+				IncludeUpperLetters: true,
+				IncludeDigits:       true,
+			},
+		},
+		{
+			name:                    "not found, no default",
+			mock:                    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
+			defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{},
+			wantErr:                 sql.ErrNoRows,
+		},
+		{
+			name:    "DB internal error",
+			mock:    mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrConnDone, queryArgs...),
+			wantErr: sql.ErrConnDone,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			execMock(t, tt.mock, func(db *sql.DB) {
+				q := &Queries{
+					client: &database.DB{
+						DB: db,
+					},
+					defaultSecretGenerators: tt.defaultSecretGenerators,
+				}
+				got, err := q.SecretGeneratorByType(ctx, generatorType)
+				if tt.wantErr != nil {
+					require.ErrorIs(t, err, tt.wantErr)
+				} else {
+					require.NoError(t, err)
+				}
+				assert.Equal(t, tt.want, got)
+			})
+		})
+	}
+}
diff --git a/internal/query/secret_generators.go b/internal/query/secret_generators.go
index ca77bc35b..1809f1d12 100644
--- a/internal/query/secret_generators.go
+++ b/internal/query/secret_generators.go
@@ -139,8 +139,29 @@ func (q *Queries) SecretGeneratorByType(ctx context.Context, generatorType domai
 		generator, err = scan(row)
 		return err
 	}, query, args...)
-	logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
-	return generator, err
+	if err == nil {
+		return generator, nil
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
+		return nil, err
+	}
+	// if the config was not (yet) stored on the database, fall back to the system / runtime config
+	defaultConfig, ok := q.defaultSecretGenerators[generatorType]
+	if !ok {
+		return nil, err // return the initial not found error
+	}
+	return &SecretGenerator{
+		AggregateID:         instanceID,
+		ResourceOwner:       instanceID,
+		GeneratorType:       generatorType,
+		Length:              defaultConfig.Length,
+		Expiry:              defaultConfig.Expiry,
+		IncludeLowerLetters: defaultConfig.IncludeLowerLetters,
+		IncludeUpperLetters: defaultConfig.IncludeUpperLetters,
+		IncludeDigits:       defaultConfig.IncludeDigits,
+		IncludeSymbols:      defaultConfig.IncludeSymbols,
+	}, nil
 }
 
 func (q *Queries) SearchSecretGenerators(ctx context.Context, queries *SecretGeneratorSearchQueries) (secretGenerators *SecretGenerators, err error) {
diff --git a/proto/zitadel/settings.proto b/proto/zitadel/settings.proto
index 68d7ac1af..cdb4533d1 100644
--- a/proto/zitadel/settings.proto
+++ b/proto/zitadel/settings.proto
@@ -56,6 +56,7 @@ enum SecretGeneratorType {
   SECRET_GENERATOR_TYPE_APP_SECRET = 6;
   SECRET_GENERATOR_TYPE_OTP_SMS = 7;
   SECRET_GENERATOR_TYPE_OTP_EMAIL = 8;
+  SECRET_GENERATOR_TYPE_INVITE_CODE = 9;
 }
 
 message SMTPConfig {