The middleware was blocking /api/trpc requests for unauthenticated users, which prevented the accept-invite page from calling the public validateInviteToken procedure. tRPC handles its own authentication via procedure middleware, so the NextAuth middleware should allow all tRPC requests through. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>