Where the invite-only gate parks an account that has not been admitted yet.

With referral_codes_required on, an account can be created by any route — password, magic link, OAuth — but cannot use the application until it has satisfied the requirement. Every authentication gate redirects here; this page is what unblocks it. See the "Invite-only access gate" section of PhoenixKit.Users.Referrals for the full rule set.

Deliberate properties, all of them inherited from the same reasoning that hardened the registration form:

• Submit-only. There is no phx-change, so a code is checked when the user says they are done, not on every keystroke. Per-keystroke checking both burns the rate limit on half-typed codes and hands an attacker a much faster oracle.
• One message for every failure. Wrong, expired, inactive, used up — all of them read the same. Distinguishing them confirms which guesses named a real code. Operators get the real reason from Logger.debug.
• Limited per account as well as per IP. This screen is behind login, so an IP-keyed limit alone is defeated by making another account.

A user who cannot get a code is not stranded: log-out is reachable from here, and it is deliberately the only other thing that is.