docs: clarify PRE_SESSION_CREATION session paths and add invitation FAQ (#739)

* fix(search): prevent SaaSKit hub from surfacing in Algolia for 'Auth logs' and other feature terms

Card titles on /home/saaskit/ were matching searches (e.g. 'Auth logs') and producing #_top links in Algolia results. Wrapped navigation card grids with data-docsearch-ignore and added robots noindex meta tag to exclude the page from search indexing.

* docs: clarify PRE_SESSION_CREATION session paths and add invitation FAQ

- Rewrite 'Modify claims in session tokens' intro to explicitly list all
  session paths covered by PRE_SESSION_CREATION (standard login, magic link,
  invitation first login, org switch) and note claims land in custom_claims key
- Add inline cross-reference to native custom scopes for scope-string use cases
- Add 'Common questions' section to add-users-to-organization with a details
  FAQ block: does PRE_SESSION_CREATION fire on invitee first login?

Addresses recurring support questions from Neosapients (Pylon #959) and Rember (Pylon #1058).
Related: SK-476

* docs: apply style and quality fixes

* docs: fix guide openers and gerund headings; refine interceptors FAQ placement

* docs(interceptors): clarify usage of PRE_SESSION_CREATION interceptor for custom claims in access tokens

* docs: simplify PRE_SESSION_CREATION session paths list to use 'standard login'

Author: saif-at-scalekit

src/configs/sidebar.config.ts

@@ -117,7 +117,7 @@ export const sidebar = [
         link: 'guides/integrations',
       },
       {
-        label: 'Go Live',
+        label: 'Go live',
         items: [
           'authenticate/launch-checklist',
           'authenticate/run-e2e-tests',

src/content/docs/authenticate/interceptors/auth-flow-interceptors.mdx

@@ -48,7 +48,7 @@ Scalekit -> User: Proceed or block sign-up
 
 ```
 
-## Implementing interceptors
+## Implement interceptors
 
 You can define interceptors at several trigger points during authentication flows.
 
@@ -729,7 +729,9 @@ async def pre_signup(request: Request):
 
 ### Modify claims in session tokens
 
-Add custom claims to Access tokens issued by Scalekit. Fetch user metadata from your database and return claims in the `response.claims` object. Claims are automatically included in the access token after authentication.
+To include additional custom claims in the access token, use the `PRE_SESSION_CREATION` interceptor. This interceptor makes an API call to your configured endpoint with user and organization data from Scalekit. You can respond with the format below, and the claims are included in the access token under the `custom_claims` key. This interceptor fires on every path that creates a new session token: standard login and organization switch.
+
+If you need custom scope strings validated directly by your resource server (for example, Spring Security's `@PreAuthorize`), use [native custom scopes and permissions](/authenticate/authz/implement-access-control/) instead — `custom_claims` do not appear in the `scope` claim.
 
 <Tabs syncKey="tech-stack">
 <TabItem value="node" label="Node.js">
@@ -846,6 +848,15 @@ After the interceptor returns custom claims, Scalekit includes them in the acces
   Keep custom claims minimal to avoid exceeding JWT size limits. Store large datasets in your database and use claims only for frequently-accessed metadata that needs to be available in the token.
 </Aside>
 
+## Common scenarios
+
+<details>
+<summary>Does `PRE_SESSION_CREATION` fire on an invitee’s first login?</summary>
+
+Yes. It fires the same as any other path that creates a session token. Custom claims your interceptor returns are embedded in the issued access token. No additional configuration is required.
+
+</details>
+
 ### Provision a user into an existing organization
 Use the **Pre-signup** interceptor to provision a user into an existing organization instead of creating a new one during signup. This is useful when you want users from specific email domains to always join a pre-defined organization, avoiding duplicate organization creation. 
 

src/content/docs/authenticate/manage-organizations/add-users-to-organization.mdx

@@ -271,4 +271,15 @@ The user will receive an email with a link to accept the invitation and join you
 
 Users belonging to multiple organizations will see an organization selection interface in subsequent login flows, allowing them to choose their desired organization.
 
-</Aside>
+</Aside>
+
+## Common questions
+
+<details>
+<summary>Does PRE_SESSION_CREATION fire on an invitee's first login?</summary>
+
+Yes. When an invitee clicks their magic link and completes signup, `PRE_SESSION_CREATION` fires the same as any other login path. Custom claims your interceptor returns are embedded in the issued JWT. No additional configuration is required.
+
+See [Intercept auth flows](/authenticate/interceptors/auth-flow-interceptors/#modify-claims-in-session-tokens).
+
+</details>

src/content/docs/authenticate/set-up-scalekit.mdx

@@ -13,7 +13,7 @@ head:
         font-size: var(--sl-text-lg);
       }
 sidebar:
-  label: 'Set up environment & SDK'
+  label: 'Set up'
 prev: false
 
 ---
@@ -22,7 +22,7 @@ import { LinkButton, Aside, Steps, Tabs, TabItem, Badge } from '@astrojs/starlig
 import { VideoPlayer } from 'starlight-videos/components'
 import InstallSDK from '@components/templates/_installsdk.mdx'
 
-This guide shows you how to set up Scalekit in your development environment. You'll configure your workspace, get API credentials, install the SDK, verify everything works correctly, and optionally set up AI-powered development tools.
+Create a Scalekit account, install the SDK, configure your credentials, and verify the setup. This prepares your environment for adding authentication to your application.
 
 Before you begin, create a Scalekit account if you haven't already. After creating your account, a Scalekit workspace is automatically set up for you with dedicated development and production environments.
 

src/content/docs/cookbooks/implement-nextjs-auth.mdx

@@ -1,5 +1,5 @@
 ---
-title: 'Implementing Passwordless Auth in Next.js 15'
+title: 'Implement passwordless auth in Next.js 15'
 description: 'Add magic link and OTP authentication to your Next.js application using Scalekit''s headless API.'
 date: 2025-02-19
 tags: ['Full stack auth', 'Next.js']

src/content/docs/dev-kit/build-with-ai/full-stack-auth.mdx

@@ -39,7 +39,7 @@ import {
   SkillsCLICodingAgentSection
 } from '@/components/templates'
 
-Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to implement Scalekit's full-stack authentication end-to-end in your web applications. This guide shows you how to configure these agents so they analyze your codebase, apply consistent authentication patterns, and generate production-ready code for login, session management, and logout that follows security best practices while reducing implementation time from hours to minutes.
+Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to implement Scalekit's full-stack authentication end-to-end in your web applications. Configure the agents to analyze your codebase, apply consistent authentication patterns, and generate production-ready code for login, session management, and logout. This approach follows security best practices while reducing implementation time from hours to minutes.
 
 <Tabs syncKey="coding-agent">
   <TabItem label="Claude Code" icon="claude">

src/content/docs/dev-kit/build-with-ai/mcp-auth.mdx

@@ -39,7 +39,7 @@ import {
   SkillsCLICodingAgentSection
 } from '@/components/templates'
 
-Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's OAuth 2.1 authentication to your MCP servers. This guide shows you how to configure these agents so they analyze your codebase, apply consistent authentication patterns, and generate production-ready code that integrates OAuth 2.1 end-to-end, reduces implementation time from hours to minutes, and follows security best practices.
+Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's OAuth 2.1 authentication to your MCP servers. Configure the agents to analyze your codebase, apply consistent authentication patterns, and generate production-ready code that integrates OAuth 2.1 end-to-end. This reduces implementation time from hours to minutes and follows security best practices.
 
 **Prerequisites**
 

src/content/docs/dev-kit/build-with-ai/scim.mdx

@@ -36,7 +36,7 @@ import {
   SkillsCLICodingAgentSection
 } from '@/components/templates'
 
-Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's Modular SCIM directory sync to your applications. This guide shows you how to configure these agents so they analyze your codebase, apply SCIM patterns, and generate production-ready code for user provisioning, deprovisioning, and lifecycle management that follows security best practices and reduces implementation time from hours to minutes.
+Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's Modular SCIM directory sync to your applications. Configure the agents to analyze your codebase, apply SCIM patterns, and generate production-ready code for user provisioning, deprovisioning, and lifecycle management. This follows security best practices and reduces implementation time from hours to minutes.
 
 <Tabs syncKey="coding-agent">
   <TabItem label="Claude Code" icon="claude">

src/content/docs/dev-kit/build-with-ai/sso.mdx

@@ -36,7 +36,7 @@ import {
   SkillsCLICodingAgentSection
 } from '@/components/templates'
 
-Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's Modular SSO to your existing applications. This guide shows you how to configure these agents so they analyze your codebase, apply SSO patterns, and generate production-ready code that integrates enterprise identity providers and follows security best practices while reducing implementation time from hours to minutes.
+Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit's Modular SSO to your existing applications. Configure the agents to analyze your codebase, apply SSO patterns, and generate production-ready code that integrates enterprise identity providers. This follows security best practices while reducing implementation time from hours to minutes.
 
 <Tabs syncKey="coding-agent">
   <TabItem label="Claude Code" icon="claude">

src/content/docs/passwordless/oidc.mdx

@@ -46,7 +46,7 @@ import Tabs from '@components/ui/Tabs.astro';
 import IconTdesignSequence from '~icons/tdesign/sequence'
 
 
-This guide shows you how to implement passwordless authentication with Scalekit over OIDC protocol. Users verify with a email verification code (OTP) or a magic link or both.
+Implement passwordless authentication with Scalekit over the OIDC protocol. Users verify their identity with an email verification code (OTP) or a magic link.
 
 <details>
 <summary><IconTdesignSequence style="display: inline; width: 1rem; height: 1rem; vertical-align: middle; margin-right: 0.5rem;" /> Review the authentication sequence</summary>