In true dansup fashion, I overengineered the Loops Invites feature.

So, to prevent enumeration, we require a captcha before validating the invite key (if you have captchas enabled, which you should)

Then we verify the invite key securely (preventing timing attacks) after a 3-5 second delay, and rate limit requests by IP.

Then we create a session token which is used in subsequent requests (like username availability/age gate)

And expires in 15 minutes.

There is more, but that's the gist 😎