diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index 7f3f7256..865652bf 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,444 +1,430 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
-use App\Jobs\SignupVerificationSMS;
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\Rules\SignupExternalEmail;
+use App\Rules\SignupToken;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /**
      * Returns plans definitions for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function plans(Request $request)
     {
         $plans = [];
 
         // Use reverse order just to have individual on left, group on right ;)
         Plan::withEnvTenantContext()->orderByDesc('title')->get()
             ->map(function ($plan) use (&$plans) {
+                // Allow themes to set custom button label
+                $button = \trans('theme::app.planbutton-' . $plan->title);
+                if ($button == 'theme::app.planbutton-' . $plan->title) {
+                    $button = \trans('app.planbutton', ['plan' => $plan->name]);
+                }
+
                 $plans[] = [
                     'title' => $plan->title,
                     'name' => $plan->name,
-                    'button' => \trans('app.planbutton', ['plan' => $plan->name]),
+                    'button' => $button,
                     'description' => $plan->description,
+                    'mode' => $plan->mode ?: 'email',
                 ];
             });
 
         return response()->json(['status' => 'success', 'plans' => $plans]);
     }
 
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
-        // Check required fields
-        $v = Validator::make(
-            $request->all(),
-            [
-                'email' => 'required',
-                'first_name' => 'max:128',
-                'last_name' => 'max:128',
-                'plan' => 'nullable|alpha_num|max:128',
-                'voucher' => 'max:32',
-            ]
-        );
+        $rules = [
+            'first_name' => 'max:128',
+            'last_name' => 'max:128',
+            'voucher' => 'max:32',
+        ];
 
-        $is_phone = false;
-        $errors = $v->fails() ? $v->errors()->toArray() : [];
+        $plan = $this->getPlan();
 
-        // Validate user email (or phone)
-        if (empty($errors['email'])) {
-            if ($error = $this->validatePhoneOrEmail($request->email, $is_phone)) {
-                $errors['email'] = $error;
-            }
+        if ($plan->mode == 'token') {
+            $rules['token'] = ['required', 'string', new SignupToken()];
+        } else {
+            $rules['email'] = ['required', 'string', new SignupExternalEmail()];
         }
 
-        if (!empty($errors)) {
-            return response()->json(['status' => 'error', 'errors' => $errors], 422);
+        // Check required fields, validate input
+        $v = Validator::make($request->all(), $rules);
+
+        if ($v->fails()) {
+            return response()->json(['status' => 'error', 'errors' => $v->errors()->toArray()], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
-                'email' => $request->email,
+                'email' => $plan->mode == 'token' ? $request->token : $request->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
-                'plan' => $request->plan,
+                'plan' => $plan->title,
                 'voucher' => $request->voucher,
         ]);
 
-        // Send email/sms message
-        if ($is_phone) {
-            SignupVerificationSMS::dispatch($code);
+        $response = [
+            'status' => 'success',
+            'code' => $code->code,
+            'mode' => $plan->mode ?: 'email',
+        ];
+
+        if ($plan->mode == 'token') {
+            // Token verification, jump to the last step
+            $has_domain = $plan->hasDomain();
+
+            $response['short_code'] = $code->short_code;
+            $response['is_domain'] = $has_domain;
+            $response['domains'] = $has_domain ? [] : Domain::getPublicDomains();
         } else {
+            // External email verification, send an email message
             SignupVerificationEmail::dispatch($code);
         }
 
-        return response()->json(['status' => 'success', 'code' => $code->code]);
+        return response()->json($response);
     }
 
     /**
      * Returns signup invitation information.
      *
      * @param string $id Signup invitation identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function invitation($id)
     {
         $invitation = SignupInvitation::withEnvTenantContext()->find($id);
 
         if (empty($invitation) || $invitation->isCompleted()) {
             return $this->errorResponse(404);
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         $result = [
             'id' => $id,
             'is_domain' => $has_domain,
             'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ];
 
         return response()->json($result);
     }
 
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (
             empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two (::destroy())
         $request->code = $code;
 
         $has_domain = $this->getPlan()->hasDomain();
 
         // Return user name and email/phone/voucher from the codes database,
         // domains list for selection and "plan type" flag
         return response()->json([
                 'status' => 'success',
                 'email' => $code->email,
                 'first_name' => $code->first_name,
                 'last_name' => $code->last_name,
                 'voucher' => $code->voucher,
                 'is_domain' => $has_domain,
                 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ]);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
                 'password' => ['required', 'confirmed', new Password()],
                 'domain' => 'required',
                 'voucher' => 'max:32',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Signup via invitation
         if ($request->invitation) {
             $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);
 
             if (empty($invitation) || $invitation->isCompleted()) {
                 return $this->errorResponse(404);
             }
 
             // Check required fields
             $v = Validator::make(
                 $request->all(),
                 [
                     'first_name' => 'max:128',
                     'last_name' => 'max:128',
                     'voucher' => 'max:32',
                 ]
             );
 
             $errors = $v->fails() ? $v->errors()->toArray() : [];
 
             if (!empty($errors)) {
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
 
             $settings = [
                 'external_email' => $invitation->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
             ];
         } else {
             // Validate verification codes (again)
             $v = $this->verify($request);
             if ($v->status() !== 200) {
                 return $v;
             }
 
             // Get user name/email from the verification code database
             $code_data = $v->getData();
 
             $settings = [
-                'external_email' => $code_data->email,
                 'first_name' => $code_data->first_name,
                 'last_name' => $code_data->last_name,
             ];
+
+            if ($this->getPlan()->mode == 'token') {
+                $settings['signup_token'] = $code_data->email;
+            } else {
+                $settings['external_email'] = $code_data->email;
+            }
         }
 
         // Find the voucher discount
         if ($request->voucher) {
             $discount = Discount::where('code', \strtoupper($request->voucher))
                 ->where('active', true)->first();
 
             if (!$discount) {
                 $errors = ['voucher' => \trans('validation.voucherinvalid')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         // Get the plan
         $plan = $this->getPlan();
         $is_domain = $plan->hasDomain();
 
         $login = $request->login;
         $domain_name = $request->domain;
 
         // Validate login
         if ($errors = self::validateLogin($login, $domain_name, $is_domain)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($login);
         $domain_name = Str::lower($domain_name);
         $domain = null;
 
         DB::beginTransaction();
 
         // Create domain record
         if ($is_domain) {
             $domain = Domain::create([
                     'namespace' => $domain_name,
                     'status' => Domain::STATUS_NEW,
                     'type' => Domain::TYPE_EXTERNAL,
             ]);
         }
 
         // Create user record
         $user = User::create([
                 'email' => $login . '@' . $domain_name,
                 'password' => $request->password,
         ]);
 
         if (!empty($discount)) {
             $wallet = $user->wallets()->first();
             $wallet->discount()->associate($discount);
             $wallet->save();
         }
 
         $user->assignPlan($plan, $domain);
 
         // Save the external email and plan in user settings
         $user->setSettings($settings);
 
         // Update the invitation
         if (!empty($invitation)) {
             $invitation->status = SignupInvitation::STATUS_COMPLETED;
             $invitation->user_id = $user->id;
             $invitation->save();
         }
 
         // Remove the verification code
         if ($request->code) {
             $request->code->delete();
         }
 
         DB::commit();
 
         return AuthController::logonResponse($user, $request->password);
     }
 
     /**
      * Returns plan for the signup process
      *
      * @returns \App\Plan Plan object selected for current signup process
      */
     protected function getPlan()
     {
         $request = request();
 
         if (!$request->plan || !$request->plan instanceof Plan) {
             // Get the plan if specified and exists...
             if ($request->code && $request->code->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->code->plan)->first();
+            } elseif ($request->plan) {
+                $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
             }
 
             // ...otherwise use the default plan
             if (empty($plan)) {
                 // TODO: Get default plan title from config
                 $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
             }
 
             $request->plan = $plan;
         }
 
         return $request->plan;
     }
 
-    /**
-     * Checks if the input string is a valid email address or a phone number
-     *
-     * @param string $input    Email address or phone number
-     * @param bool   $is_phone Will have been set to True if the string is valid phone number
-     *
-     * @return string Error message on validation error
-     */
-    protected static function validatePhoneOrEmail($input, &$is_phone = false): ?string
-    {
-        $is_phone = false;
-
-        $v = Validator::make(
-            ['email' => $input],
-            ['email' => ['required', 'string', new SignupExternalEmail()]]
-        );
-
-        if ($v->fails()) {
-            return $v->errors()->toArray()['email'][0];
-        }
-
-        // TODO: Phone number support
-/*
-        $input = str_replace(array('-', ' '), '', $input);
-
-        if (!preg_match('/^\+?[0-9]{9,12}$/', $input)) {
-            return \trans('validation.noemailorphone');
-        }
-
-        $is_phone = true;
-*/
-        return null;
-    }
-
     /**
      * Login (kolab identity) validation
      *
      * @param string $login    Login (local part of an email address)
      * @param string $domain   Domain name
      * @param bool   $external Enables additional checks for domain part
      *
      * @return array Error messages on validation error
      */
     protected static function validateLogin($login, $domain, $external = false): ?array
     {
         // Validate login part alone
         $v = Validator::make(
             ['login' => $login],
             ['login' => ['required', 'string', new UserEmailLocal($external)]]
         );
 
         if ($v->fails()) {
             return ['login' => $v->errors()->toArray()['login'][0]];
         }
 
         $domains = $external ? null : Domain::getPublicDomains();
 
         // Validate the domain
         $v = Validator::make(
             ['domain' => $domain],
             ['domain' => ['required', 'string', new UserEmailDomain($domains)]]
         );
 
         if ($v->fails()) {
             return ['domain' => $v->errors()->toArray()['domain'][0]];
         }
 
         $domain = Str::lower($domain);
 
         // Check if domain is already registered with us
         if ($external) {
             if (Domain::withTrashed()->where('namespace', $domain)->exists()) {
                 return ['domain' => \trans('validation.domainexists')];
             }
         }
 
         // Check if user with specified login already exists
         $email = $login . '@' . $domain;
         if (User::emailExists($email) || User::aliasExists($email) || \App\Group::emailExists($email)) {
             return ['login' => \trans('validation.loginexists')];
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/ContentController.php b/src/app/Http/Controllers/ContentController.php
index 93df377e..e626e9b4 100644
--- a/src/app/Http/Controllers/ContentController.php
+++ b/src/app/Http/Controllers/ContentController.php
@@ -1,173 +1,157 @@
 <?php
 
 namespace App\Http\Controllers;
 
 class ContentController extends Controller
 {
     /**
      * Get the HTML content for the specified page
      *
      * @param string $page Page template identifier
      *
      * @return \Illuminate\View\View
      */
     public function pageContent(string $page)
     {
         if (empty($page) || !preg_match('/^[a-z\/]+$/', $page)) {
             abort(404);
         }
 
         $theme = \config('app.theme');
         $page = str_replace('/', '.', $page);
 
         $file = "themes/{$theme}/pages/{$page}.blade.php";
         $view = "{$theme}.pages.{$page}";
 
         if (!file_exists(resource_path($file))) {
             abort(404);
         }
 
-        self::loadLocale($theme);
-
         return view($view)->with('env', \App\Utils::uiEnv());
     }
 
     /**
      * Get the list of FAQ entries for the specified page
      *
      * @param string $page Page path
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function faqContent(string $page)
     {
         if (empty($page)) {
             return $this->errorResponse(404);
         }
 
         $faq = [];
 
         $theme_name = \config('app.theme');
         $theme_file = resource_path("themes/{$theme_name}/theme.json");
 
         if (file_exists($theme_file)) {
             $theme = json_decode(file_get_contents($theme_file), true);
             if (json_last_error() != JSON_ERROR_NONE) {
                 \Log::error("Failed to parse $theme_file: " . json_last_error_msg());
             } elseif (!empty($theme['faq']) && !empty($theme['faq'][$page])) {
                 $faq = $theme['faq'][$page];
             }
 
             // TODO: Support pages with variables, e.g. users/<user-id>
         }
 
         // Localization
         if (!empty($faq)) {
-            self::loadLocale($theme_name);
-
             foreach ($faq as $idx => $item) {
                 if (!empty($item['label'])) {
                     $faq[$idx]['title'] = \trans('theme::faq.' . $item['label']);
                 }
             }
         }
 
         return response()->json(['status' => 'success', 'faq' => $faq]);
     }
 
     /**
      * Returns list of enabled locales
      *
      * @return array List of two-letter language codes
      */
     public static function locales(): array
     {
         if ($locales = \env('APP_LOCALES')) {
             return preg_split('/\s*,\s*/', strtolower(trim($locales)));
         }
 
         return ['en', 'de', 'fr'];
     }
 
     /**
      * Get menu definition from the theme
      *
      * @return array
      */
     public static function menu(): array
     {
         $theme_name = \config('app.theme');
         $theme_file = resource_path("themes/{$theme_name}/theme.json");
         $menu = [];
 
         if (file_exists($theme_file)) {
             $theme = json_decode(file_get_contents($theme_file), true);
 
             if (json_last_error() != JSON_ERROR_NONE) {
                 \Log::error("Failed to parse $theme_file: " . json_last_error_msg());
             } elseif (!empty($theme['menu'])) {
                 $menu = $theme['menu'];
             }
         }
 
         // TODO: These 2-3 lines could become a utility function somewhere
         $req_domain = preg_replace('/:[0-9]+$/', '', request()->getHttpHost());
         $sys_domain = \config('app.domain');
         $isAdmin = $req_domain == "admin.$sys_domain";
 
         $filter = function ($item) use ($isAdmin) {
             if ($isAdmin && empty($item['admin'])) {
                 return false;
             }
             if (!$isAdmin && !empty($item['admin']) && $item['admin'] === 'only') {
                 return false;
             }
 
             return true;
         };
 
         $menu = array_values(array_filter($menu, $filter));
 
         // Load localization files for all supported languages
         $lang_path = resource_path("themes/{$theme_name}/lang");
         $locales = [];
         foreach (self::locales() as $lang) {
             $file = "{$lang_path}/{$lang}/menu.php";
             if (file_exists($file)) {
                 $locales[$lang] = include $file;
             }
         }
 
         foreach ($menu as $idx => $item) {
             // Handle menu localization
             if (!empty($item['label'])) {
                 $label = $item['label'];
 
                 foreach ($locales as $lang => $labels) {
                     if (!empty($labels[$label])) {
                         $item["title-{$lang}"] = $labels[$label];
                     }
                 }
             }
 
             // Unset properties that we don't need on the client side
             unset($item['admin'], $item['label']);
 
             $menu[$idx] = $item;
         }
 
         return $menu;
     }
-
-    /**
-     * Register localization files from the theme.
-     *
-     * @param string $theme Theme name
-     */
-    protected static function loadLocale(string $theme): void
-    {
-        $path = resource_path(sprintf('themes/%s/lang', $theme));
-
-        \app('translator')->addNamespace('theme', $path);
-    }
 }
diff --git a/src/app/Http/Middleware/Locale.php b/src/app/Http/Middleware/Locale.php
index e4ffb14d..3fb5fbf7 100644
--- a/src/app/Http/Middleware/Locale.php
+++ b/src/app/Http/Middleware/Locale.php
@@ -1,69 +1,73 @@
 <?php
 
 namespace App\Http\Middleware;
 
 use Closure;
 use Illuminate\Http\Request;
 
 class Locale
 {
     /**
      * Handle an incoming request.
      *
      * @param \Illuminate\Http\Request $request
      * @param \Closure                 $next
      *
      * @return mixed
      */
     public function handle(Request $request, Closure $next)
     {
         $langDir = resource_path('lang');
         $enabledLanguages = \App\Http\Controllers\ContentController::locales();
         $lang = null;
 
         // setLocale() will modify the app.locale config entry, so any subsequent
         // request under Swoole would use the changed locale, causing "locale leak"
         // to other users' requests, unless we use env() instead of config() here.
         $default = \env('APP_LOCALE', 'en');
 
         // Try to get the language from the cookie
         if (
             ($cookie = $request->cookie('language'))
             && in_array($cookie, $enabledLanguages)
             && ($cookie == $default || file_exists("$langDir/$cookie"))
         ) {
             $lang = $cookie;
         }
 
         // If there's no cookie select try the browser languages
         if (!$lang) {
             $preferences = array_map(
                 function ($lang) {
                     return preg_replace('/[^a-z].*$/', '', strtolower($lang));
                 },
                 $request->getLanguages()
             );
 
             foreach ($preferences as $pref) {
                 if (
                     !empty($pref)
                     && in_array($pref, $enabledLanguages)
                     && ($pref == $default || file_exists("$langDir/$pref"))
                 ) {
                     $lang = $pref;
                     break;
                 }
             }
         }
 
         if (!$lang) {
             $lang = $default;
         }
 
         if (!app()->isLocale($lang)) {
             app()->setLocale($lang);
         }
 
+        // Allow skins to define/overwrite some localization
+        $theme = \config('app.theme');
+        \app('translator')->addNamespace('theme', \resource_path("themes/{$theme}/lang"));
+
         return $next($request);
     }
 }
diff --git a/src/app/Observers/SignupCodeObserver.php b/src/app/Observers/SignupCodeObserver.php
index 6ae0b6d6..96c0fb8a 100644
--- a/src/app/Observers/SignupCodeObserver.php
+++ b/src/app/Observers/SignupCodeObserver.php
@@ -1,77 +1,77 @@
 <?php
 
 namespace App\Observers;
 
 use App\SignupCode;
 use Carbon\Carbon;
 use Illuminate\Support\Str;
 
 class SignupCodeObserver
 {
     /**
      * Handle the "creating" event.
      *
      * Ensure that the code entry is created with a random code/short_code.
      *
      * @param \App\SignupCode $code The code being created.
      *
      * @return void
      */
     public function creating(SignupCode $code): void
     {
         $code_length = SignupCode::CODE_LENGTH;
         $exp_hours   = env('SIGNUP_CODE_EXPIRY', SignupCode::CODE_EXP_HOURS);
 
         if (empty($code->code)) {
             $code->short_code = SignupCode::generateShortCode();
 
             // FIXME: Replace this with something race-condition free
             while (true) {
                 $code->code = Str::random($code_length);
                 if (!SignupCode::find($code->code)) {
                     break;
                 }
             }
         }
 
         $code->headers = collect(request()->headers->all())
             ->filter(function ($value, $key) {
                 // remove some headers we don't care about
                 return !in_array($key, ['cookie', 'referer', 'x-test-payment-provider', 'origin']);
             })
             ->map(function ($value) {
                 return is_array($value) && count($value) == 1 ? $value[0] : $value;
             })
             ->all();
 
         $code->expires_at = Carbon::now()->addHours($exp_hours);
         $code->ip_address = request()->ip();
 
-        if ($code->email) {
+        if ($code->email && strpos($code->email, '@')) {
             $parts = explode('@', $code->email);
 
             $code->local_part = $parts[0];
             $code->domain_part = $parts[1];
         }
     }
 
     /**
      * Handle the "updating" event.
      *
      * @param SignupCode $code The code being updated.
      *
      * @return void
      */
     public function updating(SignupCode $code)
     {
         if ($code->email) {
             $parts = explode('@', $code->email);
 
             $code->local_part = $parts[0];
             $code->domain_part = $parts[1];
         } else {
             $code->local_part = null;
             $code->domain_part = null;
         }
     }
 }
diff --git a/src/app/Plan.php b/src/app/Plan.php
index bdfe80dd..149a9ef0 100644
--- a/src/app/Plan.php
+++ b/src/app/Plan.php
@@ -1,118 +1,120 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Plan.
  *
  * A Plan is a grouping of packages, such as a "Family Plan".
  *
  * A "Family Plan" as such may exist of "2 or more Kolab packages",
  * and apply a discount for the third and further Kolab packages.
  *
  * @property string         $description
  * @property int            $discount_qty
  * @property int            $discount_rate
  * @property string         $id
+ * @property string         $mode           Plan signup mode (email|token)
  * @property string         $name
  * @property \App\Package[] $packages
  * @property datetime       $promo_from
  * @property datetime       $promo_to
  * @property ?int           $tenant_id
  * @property string         $title
  */
 class Plan extends Model
 {
     use BelongsToTenantTrait;
     use HasTranslations;
     use UuidStrKeyTrait;
 
     public $timestamps = false;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'title',
+        'mode',
         'name',
         'description',
         // a start and end datetime for this promotion
         'promo_from',
         'promo_to',
         // discounts start at this quantity
         'discount_qty',
         // the rate of the discount for this plan
         'discount_rate',
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'promo_from' => 'datetime:Y-m-d H:i:s',
         'promo_to' => 'datetime:Y-m-d H:i:s',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer'
     ];
 
     /** @var array<int, string> Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The list price for this package at the minimum configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->packages as $package) {
             $costs += $package->pivot->cost();
         }
 
         return $costs;
     }
 
     /**
      * The relationship to packages.
      *
      * The plan contains one or more packages. Each package may have its minimum number (for
      * billing) or its maximum (to allow topping out "enterprise" customers on a "small business"
      * plan).
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(Package::class, 'plan_packages')
             ->using(PlanPackage::class)
             ->withPivot([
                     'qty',
                     'qty_min',
                     'qty_max',
                     'discount_qty',
                     'discount_rate'
             ]);
     }
 
     /**
      * Checks if the plan has any type of domain SKU assigned.
      *
      * @return bool
      */
     public function hasDomain(): bool
     {
         foreach ($this->packages as $package) {
             if ($package->isDomain()) {
                 return true;
             }
         }
 
         return false;
     }
 }
diff --git a/src/app/Rules/SignupToken.php b/src/app/Rules/SignupToken.php
new file mode 100644
index 00000000..30853a89
--- /dev/null
+++ b/src/app/Rules/SignupToken.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Rules;
+
+use Illuminate\Contracts\Validation\Rule;
+
+class SignupToken implements Rule
+{
+    protected $message;
+
+    /**
+     * Determine if the validation rule passes.
+     *
+     * @param string $attribute Attribute name
+     * @param mixed  $token     The value to validate
+     *
+     * @return bool
+     */
+    public function passes($attribute, $token): bool
+    {
+        // Check the max length, according to the database column length
+        if (!is_string($token) || strlen($token) > 191) {
+            $this->message = \trans('validation.signuptokeninvalid');
+            return false;
+        }
+
+        // Check the list of tokens for token existence
+        $file = storage_path('signup-tokens.txt');
+        $list = [];
+        $token = \strtoupper($token);
+
+        if (file_exists($file)) {
+            $list = file($file);
+            $list = array_map('trim', $list);
+            $list = array_map('strtoupper', $list);
+        } else {
+            \Log::error("Signup tokens file ({$file}) does not exist");
+        }
+
+        if (!in_array($token, $list)) {
+            $this->message = \trans('validation.signuptokeninvalid');
+            return false;
+        }
+
+        // Check if the token has been already used for registration (exclude deleted users)
+        $used = \App\User::select()
+            ->join('user_settings', 'users.id', '=', 'user_settings.user_id')
+            ->where('user_settings.key', 'signup_token')
+            ->where('user_settings.value', $token)
+            ->exists();
+
+        if ($used) {
+            $this->message = \trans('validation.signuptokeninvalid');
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Get the validation error message.
+     *
+     * @return string
+     */
+    public function message(): ?string
+    {
+        return $this->message;
+    }
+}
diff --git a/src/database/migrations/2022_09_01_100000_plans_mode.php b/src/database/migrations/2022_09_01_100000_plans_mode.php
new file mode 100644
index 00000000..68ff8c46
--- /dev/null
+++ b/src/database/migrations/2022_09_01_100000_plans_mode.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table(
+            'plans',
+            function (Blueprint $table) {
+                $table->string('mode', 32)->default('email');
+            }
+        );
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table(
+            'plans',
+            function (Blueprint $table) {
+                $table->dropColumn('mode');
+            }
+        );
+    }
+};
diff --git a/src/resources/lang/en/ui.php b/src/resources/lang/en/ui.php
index 8bcb3c31..02a1a9c4 100644
--- a/src/resources/lang/en/ui.php
+++ b/src/resources/lang/en/ui.php
@@ -1,536 +1,537 @@
 <?php
 
 /**
  * This file will be converted to a Vue-i18n compatible JSON format on build time
  *
  * Note: The Laravel localization features do not work here. Vue-i18n rules are different
  */
 
 return [
 
     'app' => [
         'faq' => "FAQ",
     ],
 
     'btn' => [
         'add' => "Add",
         'accept' => "Accept",
         'back' => "Back",
         'cancel' => "Cancel",
         'close' => "Close",
         'continue' => "Continue",
         'copy' => "Copy",
         'delete' => "Delete",
         'deny' => "Deny",
         'download' => "Download",
         'edit' => "Edit",
         'file' => "Choose file...",
         'moreinfo' => "More information",
         'refresh' => "Refresh",
         'reset' => "Reset",
         'resend' => "Resend",
         'save' => "Save",
         'search' => "Search",
         'share' => "Share",
         'signup' => "Sign Up",
         'submit' => "Submit",
         'suspend' => "Suspend",
         'unsuspend' => "Unsuspend",
         'verify' => "Verify",
     ],
 
     'companion' => [
         'title' => "Companion App",
         'name' => "Name",
         'description' => "Use the Companion App on your mobile phone for advanced two factor authentication.",
         'pair-new' => "Pair new device",
         'paired' => "Paired devices",
         'pairing-instructions' => "Pair a new device using the following QR-Code:",
         'deviceid' => "Device ID",
         'list-empty' => "There are currently no devices",
         'delete' => "Remove devices",
         'remove-devices' => "Remove Devices",
         'remove-devices-text' => "Do you really want to remove all devices permanently?"
             . " Please note that this action cannot be undone, and you can only remove all devices together."
             . " You may pair devices you would like to keep individually again.",
     ],
 
     'dashboard' => [
         'beta' => "beta",
         'distlists' => "Distribution lists",
         'chat' => "Video chat",
         'companion' => "Companion app",
         'domains' => "Domains",
         'files' => "Files",
         'invitations' => "Invitations",
         'profile' => "Your profile",
         'resources' => "Resources",
         'settings' => "Settings",
         'shared-folders' => "Shared folders",
         'users' => "User accounts",
         'wallet' => "Wallet",
         'webmail' => "Webmail",
         'stats' => "Stats",
     ],
 
     'distlist' => [
         'list-title' => "Distribution list | Distribution lists",
         'create' => "Create list",
         'delete' => "Delete list",
         'email' => "Email",
         'list-empty' => "There are no distribution lists in this account.",
         'name' => "Name",
         'new' => "New distribution list",
         'recipients' => "Recipients",
         'sender-policy' => "Sender Access List",
         'sender-policy-text' => "With this list you can specify who can send mail to the distribution list."
             . " You can put a complete email address (jane@kolab.org), domain (kolab.org) or suffix (.org) that the sender email address is compared to."
             . " If the list is empty, mail from anyone is allowed.",
     ],
 
     'domain' => [
         'delete' => "Delete domain",
         'delete-domain' => "Delete {domain}",
         'delete-text' => "Do you really want to delete this domain permanently?"
             . " This is only possible if there are no users, aliases or other objects in this domain."
             . " Please note that this action cannot be undone.",
         'dns-verify' => "Domain DNS verification sample:",
         'dns-config' => "Domain DNS configuration sample:",
         'list-empty' => "There are no domains in this account.",
         'namespace' => "Namespace",
         'spf-whitelist' => "SPF Whitelist",
         'spf-whitelist-text' => "The Sender Policy Framework allows a sender domain to disclose, through DNS, "
             . "which systems are allowed to send emails with an envelope sender address within said domain.",
         'spf-whitelist-ex' => "Here you can specify a list of allowed servers, for example: <var>.ess.barracuda.com</var>.",
         'verify' => "Domain verification",
         'verify-intro' => "In order to confirm that you're the actual holder of the domain, we need to run a verification process before finally activating it for email delivery.",
         'verify-dns' => "The domain <b>must have one of the following entries</b> in DNS:",
         'verify-dns-txt' => "TXT entry with value:",
         'verify-dns-cname' => "or CNAME entry:",
         'verify-outro' => "When this is done press the button below to start the verification.",
         'verify-sample' => "Here's a sample zone file for your domain:",
         'config' => "Domain configuration",
         'config-intro' => "In order to let {app} receive email traffic for your domain you need to adjust the DNS settings, more precisely the MX entries, accordingly.",
         'config-sample' => "Edit your domain's zone file and replace existing MX entries with the following values:",
         'config-hint' => "If you don't know how to set DNS entries for your domain, please contact the registration service where you registered the domain or your web hosting provider.",
         'create' => "Create domain",
         'new' => "New domain",
     ],
 
     'error' => [
         '400' => "Bad request",
         '401' => "Unauthorized",
         '403' => "Access denied",
         '404' => "Not found",
         '405' => "Method not allowed",
         '500' => "Internal server error",
         'unknown' => "Unknown Error",
         'server' => "Server Error",
         'form' => "Form validation error",
     ],
 
     'file' => [
         'create' => "Create file",
         'delete' => "Delete file",
         'list-empty' => "There are no files in this account.",
         'mimetype' => "Mimetype",
         'mtime' => "Modified",
         'new' => "New file",
         'search' => "File name",
         'sharing' => "Sharing",
         'sharing-links-text' => "You can share the file with other users by giving them read-only access "
             . "to the file via a unique link.",
     ],
 
     'form' => [
         'acl' => "Access rights",
         'acl-full' => "All",
         'acl-read-only' => "Read-only",
         'acl-read-write' => "Read-write",
         'amount' => "Amount",
         'anyone' => "Anyone",
         'code' => "Confirmation Code",
         'config' => "Configuration",
         'date' => "Date",
         'description' => "Description",
         'details' => "Details",
         'disabled' => "disabled",
         'domain' => "Domain",
         'email' => "Email Address",
         'emails' => "Email Addresses",
         'enabled' => "enabled",
         'firstname' => "First Name",
         'general' => "General",
         'geolocation' => "Your current location: {location}",
         'lastname' => "Last Name",
         'name' => "Name",
         'months' => "months",
         'none' => "none",
         'norestrictions' => "No restrictions",
         'or' => "or",
         'password' => "Password",
         'password-confirm' => "Confirm Password",
         'phone' => "Phone",
         'selectcountries' => "Select countries",
         'settings' => "Settings",
         'shared-folder' => "Shared Folder",
         'size' => "Size",
         'status' => "Status",
         'subscriptions' => "Subscriptions",
         'surname' => "Surname",
         'type' => "Type",
         'unknown' => "unknown",
         'user' => "User",
         'primary-email' => "Primary Email",
         'id' => "ID",
         'created' => "Created",
         'deleted' => "Deleted",
     ],
 
     'invitation' => [
         'create' => "Create invite(s)",
         'create-title' => "Invite for a signup",
         'create-email' => "Enter an email address of the person you want to invite.",
         'create-csv' => "To send multiple invitations at once, provide a CSV (comma separated) file, or alternatively a plain-text file, containing one email address per line.",
         'list-empty' => "There are no invitations in the database.",
         'title' => "Signup invitations",
         'search' => "Email address or domain",
         'send' => "Send invite(s)",
         'status-completed' => "User signed up",
         'status-failed' => "Sending failed",
         'status-sent' => "Sent",
         'status-new' => "Not sent yet",
     ],
 
     'lang' => [
         'en' => "English",
         'de' => "German",
         'fr' => "French",
         'it' => "Italian",
     ],
 
     'login' => [
         '2fa' => "Second factor code",
         '2fa_desc' => "Second factor code is optional for users with no 2-Factor Authentication setup.",
         'forgot_password' => "Forgot password?",
         'header' => "Please sign in",
         'sign_in' => "Sign in",
         'signing_in' => "Signing in...",
         'webmail' => "Webmail"
     ],
 
     'meet' => [
         // Room options dialog
         'options' => "Room options",
         'password' => "Password",
         'password-none' => "none",
         'password-clear' => "Clear password",
         'password-set' => "Set password",
         'password-text' => "You can add a password to your meeting. Participants will have to provide the password before they are allowed to join the meeting.",
         'lock' => "Locked room",
         'lock-text' => "When the room is locked participants have to be approved by a moderator before they could join the meeting.",
         'nomedia' => "Subscribers only",
         'nomedia-text' => "Forces all participants to join as subscribers (with camera and microphone turned off)."
             . " Moderators will be able to promote them to publishers throughout the session.",
 
         // Room menu
         'partcnt' => "Number of participants",
         'menu-audio-mute' => "Mute audio",
         'menu-audio-unmute' => "Unmute audio",
         'menu-video-mute' => "Mute video",
         'menu-video-unmute' => "Unmute video",
         'menu-screen' => "Share screen",
         'menu-hand-lower' => "Lower hand",
         'menu-hand-raise' => "Raise hand",
         'menu-channel' => "Interpreted language channel",
         'menu-chat' => "Chat",
         'menu-fullscreen' => "Full screen",
         'menu-fullscreen-exit' => "Exit full screen",
         'menu-leave' => "Leave session",
 
         // Room setup screen
         'setup-title' => "Set up your session",
         'mic' => "Microphone",
         'cam' => "Camera",
         'nick' => "Nickname",
         'nick-placeholder' => "Your name",
         'join' => "JOIN",
         'joinnow' => "JOIN NOW",
         'imaowner' => "I'm the owner",
 
         // Room
         'qa' => "Q & A",
         'leave-title' => "Room closed",
         'leave-body' => "The session has been closed by the room owner.",
         'media-title' => "Media setup",
         'join-request' => "Join request",
         'join-requested' => "{user} requested to join.",
 
         // Status messages
         'status-init' => "Checking the room...",
         'status-323' => "The room is closed. Please, wait for the owner to start the session.",
         'status-324' => "The room is closed. It will be open for others after you join.",
         'status-325' => "The room is ready. Please, provide a valid password.",
         'status-326' => "The room is locked. Please, enter your name and try again.",
         'status-327' => "Waiting for permission to join the room.",
         'status-404' => "The room does not exist.",
         'status-429' => "Too many requests. Please, wait.",
         'status-500' => "Failed to connect to the room. Server error.",
 
         // Other menus
         'media-setup' => "Media setup",
         'perm' => "Permissions",
         'perm-av' => "Audio &amp; Video publishing",
         'perm-mod' => "Moderation",
         'lang-int' => "Language interpreter",
         'menu-options' => "Options",
     ],
 
     'menu' => [
         'cockpit' => "Cockpit",
         'login' => "Login",
         'logout' => "Logout",
         'signup' => "Signup",
         'toggle' => "Toggle navigation",
     ],
 
     'msg' => [
         'initializing' => "Initializing...",
         'loading' => "Loading...",
         'loading-failed' => "Failed to load data.",
         'notfound' => "Resource not found.",
         'info' => "Information",
         'error' => "Error",
         'uploading' => "Uploading...",
         'warning' => "Warning",
         'success' => "Success",
     ],
 
     'nav' => [
         'more' => "Load more",
         'step' => "Step {i}/{n}",
     ],
 
     'password' => [
         'link-invalid' => "The password reset code is expired or invalid.",
         'reset' => "Password Reset",
         'reset-step1' => "Enter your email address to reset your password.",
         'reset-step1-hint' => "You may need to check your spam folder or unblock {email}.",
         'reset-step2' => "We sent out a confirmation code to your external email address."
             . " Enter the code we sent you, or click the link in the message.",
     ],
 
     'resource' => [
         'create' => "Create resource",
         'delete' => "Delete resource",
         'invitation-policy' => "Invitation policy",
         'invitation-policy-text' => "Event invitations for a resource are normally accepted automatically"
             . " if there is no conflicting event on the requested time slot. Invitation policy allows"
             . " for rejecting such requests or to require a manual acceptance from a specified user.",
         'ipolicy-manual' => "Manual (tentative)",
         'ipolicy-accept' => "Accept",
         'ipolicy-reject' => "Reject",
         'list-title' => "Resource | Resources",
         'list-empty' => "There are no resources in this account.",
         'new' => "New resource",
     ],
 
     'room' => [
         'create' => "Create room",
         'delete' => "Delete room",
         'copy-location' => "Copy room location",
         'description-hint' => "This is an optional short description for the room, so you can find it more easily on the list.",
         'goto' => "Enter the room",
         'list-empty' => "There are no conference rooms in this account.",
         'list-empty-nocontroller' => "Do you need a room? Ask your account owner to create one and share it with you.",
         'list-title' => "Voice & video conferencing rooms",
         'moderators' => "Moderators",
         'moderators-text' => "You can share your room with other users. They will become the room moderators with all moderator powers and ability to open the room without your presence.",
         'new' => "New room",
         'new-hint' => "We'll generate a unique name for the room that will then allow you to access the room.",
         'title' => "Room: {name}",
         'url' => "You can access the room at the URL below. Use this URL to invite people to join you. This room is only open when you (or another room moderator) is in attendance.",
     ],
 
     'settings' => [
         'password-policy' => "Password Policy",
         'password-retention' => "Password Retention",
         'password-max-age' => "Require a password change every",
     ],
 
     'shf' => [
         'aliases-none' => "This shared folder has no email aliases.",
         'create' => "Create folder",
         'delete' => "Delete folder",
         'acl-text' => "Defines user permissions to access the shared folder.",
         'list-title' => "Shared folder | Shared folders",
         'list-empty' => "There are no shared folders in this account.",
         'new' => "New shared folder",
         'type-mail' => "Mail",
         'type-event' => "Calendar",
         'type-contact' => "Address Book",
         'type-task' => "Tasks",
         'type-note' => "Notes",
         'type-file' => "Files",
     ],
 
     'signup' => [
         'email' => "Existing Email Address",
         'login' => "Login",
         'title' => "Sign Up",
         'step1' => "Sign up to start your free month.",
         'step2' => "We sent out a confirmation code to your email address. Enter the code we sent you, or click the link in the message.",
         'step3' => "Create your Kolab identity (you can choose additional addresses later).",
+        'token' => "Signup authorization token",
         'voucher' => "Voucher Code",
     ],
 
     'status' => [
         'prepare-account' => "We are preparing your account.",
         'prepare-domain' => "We are preparing the domain.",
         'prepare-distlist' => "We are preparing the distribution list.",
         'prepare-resource' => "We are preparing the resource.",
         'prepare-shared-folder' => "We are preparing the shared folder.",
         'prepare-user' => "We are preparing the user account.",
         'prepare-hint' => "Some features may be missing or readonly at the moment.",
         'prepare-refresh' => "The process never ends? Press the \"Refresh\" button, please.",
         'ready-account' => "Your account is almost ready.",
         'ready-domain' => "The domain is almost ready.",
         'ready-distlist' => "The distribution list is almost ready.",
         'ready-resource' => "The resource is almost ready.",
         'ready-shared-folder' => "The shared-folder is almost ready.",
         'ready-user' => "The user account is almost ready.",
         'verify' => "Verify your domain to finish the setup process.",
         'verify-domain' => "Verify domain",
         'degraded' => "Degraded",
         'deleted' => "Deleted",
         'suspended' => "Suspended",
         'notready' => "Not Ready",
         'active' => "Active",
     ],
 
     'support' => [
         'title' => "Contact Support",
         'id' => "Customer number or email address you have with us",
         'id-pl' => "e.g. 12345678 or john@kolab.org",
         'id-hint' => "Leave blank if you are not a customer yet",
         'name' => "Name",
         'name-pl' => "how we should call you in our reply",
         'email' => "Working email address",
         'email-pl' => "make sure we can reach you at this address",
         'summary' => "Issue Summary",
         'summary-pl' => "one sentence that summarizes your issue",
         'expl' => "Issue Explanation",
     ],
 
     'user' => [
         '2fa-hint1' => "This will remove 2-Factor Authentication entitlement as well as the user-configured factors.",
         '2fa-hint2' => "Please, make sure to confirm the user identity properly.",
         'add-beta' => "Enable beta program",
         'address' => "Address",
         'aliases' => "Aliases",
         'aliases-none' => "This user has no email aliases.",
         'add-bonus' => "Add bonus",
         'add-bonus-title' => "Add a bonus to the wallet",
         'add-penalty' => "Add penalty",
         'add-penalty-title' => "Add a penalty to the wallet",
         'auto-payment' => "Auto-payment",
         'auto-payment-text' => "Fill up by <b>{amount}</b> when under <b>{balance}</b> using {method}",
         'country' => "Country",
         'create' => "Create user",
         'custno' => "Customer No.",
         'degraded-warning' => "The account is degraded. Some features have been disabled.",
         'degraded-hint' => "Please, make a payment.",
         'delete' => "Delete user",
         'delete-account' => "Delete this account?",
         'delete-email' => "Delete {email}",
         'delete-text' => "Do you really want to delete this user permanently?"
             . " This will delete all account data and withdraw the permission to access the email account."
             . " Please note that this action cannot be undone.",
         'discount' => "Discount",
         'discount-hint' => "applied discount",
         'discount-title' => "Account discount",
         'distlists' => "Distribution lists",
         'domains' => "Domains",
         'ext-email' => "External Email",
         'email-aliases' => "Email Aliases",
         'finances' => "Finances",
         'geolimit' => "Geo-lockin",
         'geolimit-text' => "Defines a list of locations that are allowed for logon. You will not be able to login from a country that is not listed here.",
         'greylisting' => "Greylisting",
         'greylisting-text' => "Greylisting is a method of defending users against spam. Any incoming mail from an unrecognized sender "
             . "is temporarily rejected. The originating server should try again after a delay. "
             . "This time the email will be accepted. Spammers usually do not reattempt mail delivery.",
         'list-title' => "User accounts",
         'list-empty' => "There are no users in this account.",
         'managed-by' => "Managed by",
         'new' => "New user account",
         'org' => "Organization",
         'package' => "Package",
         'pass-input' => "Enter password",
         'pass-link' => "Set via link",
         'pass-link-label' => "Link:",
         'pass-link-hint' => "Press Submit to activate the link",
         'passwordpolicy' => "Password Policy",
         'price' => "Price",
         'profile-title' => "Your profile",
         'profile-delete' => "Delete account",
         'profile-delete-title' => "Delete this account?",
         'profile-delete-text1' => "This will delete the account as well as all domains, users and aliases associated with this account.",
         'profile-delete-warning' => "This operation is irreversible",
         'profile-delete-text2' => "As you will not be able to recover anything after this point, please make sure that you have migrated all data before proceeding.",
         'profile-delete-support' => "As we always strive to improve, we would like to ask for 2 minutes of your time. "
             . "The best tool for improvement is feedback from users, and we would like to ask "
             . "for a few words about your reasons for leaving our service. Please send your feedback to <a href=\"{href}\">{email}</a>.",
         'profile-delete-contact' => "Also feel free to contact {app} Support with any questions or concerns that you may have in this context.",
         'reset-2fa' => "Reset 2-Factor Auth",
         'reset-2fa-title' => "2-Factor Authentication Reset",
         'resources' => "Resources",
         'title' => "User account",
         'search' => "User email address or name",
         'search-pl' => "User ID, email or domain",
         'skureq' => "{sku} requires {list}.",
         'subscription' => "Subscription",
         'subscriptions-none' => "This user has no subscriptions.",
         'users' => "Users",
     ],
 
     'wallet' => [
         'add-credit' => "Add credit",
         'auto-payment-cancel' => "Cancel auto-payment",
         'auto-payment-change' => "Change auto-payment",
         'auto-payment-failed' => "The setup of automatic payments failed. Restart the process to enable automatic top-ups.",
         'auto-payment-hint' => "Here is how it works: Every time your account runs low, we will charge your preferred payment method for an amount you choose."
             . " You can cancel or change the auto-payment option at any time.",
         'auto-payment-setup' => "Set up auto-payment",
         'auto-payment-disabled' => "The configured auto-payment has been disabled. Top up your wallet or raise the auto-payment amount.",
         'auto-payment-info' => "Auto-payment is <b>set</b> to fill up your account by <b>{amount}</b> every time your account balance gets under <b>{balance}</b>.",
         'auto-payment-inprogress' => "The setup of the automatic payment is still in progress.",
         'auto-payment-next' => "Next, you will be redirected to the checkout page, where you can provide your credit card details.",
         'auto-payment-disabled-next' => "The auto-payment is disabled. Immediately after you submit new settings we'll enable it and attempt to top up your wallet.",
         'auto-payment-update' => "Update auto-payment",
         'banktransfer-hint' => "Please note that a bank transfer can take several days to complete.",
         'coinbase-hint' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then create a charge on Coinbase for the specified amount that you can pay using Bitcoin.",
         'currency-conv' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then convert this to {pc}, and on the next page you will be provided with the bank-details to transfer the amount in {pc}.",
         'fill-up' => "Fill up by",
         'history' => "History",
         'month' => "month",
         'noperm' => "Only account owners can access a wallet.",
         'norefund' => "The money in your wallet is non-refundable.",
         'payment-amount-hint' => "Choose the amount by which you want to top up your wallet.",
         'payment-method' => "Method of payment: {method}",
         'payment-warning' => "You will be charged for {price}.",
         'pending-payments' => "Pending Payments",
         'pending-payments-warning' => "You have payments that are still in progress. See the \"Pending Payments\" tab below.",
         'pending-payments-none' => "There are no pending payments for this account.",
         'receipts' => "Receipts",
         'receipts-hint' => "Here you can download receipts (in PDF format) for payments in specified period. Select the period and press the Download button.",
         'receipts-none' => "There are no receipts for payments in this account. Please, note that you can download receipts after the month ends.",
         'title' => "Account balance",
         'top-up' => "Top up your wallet",
         'transactions' => "Transactions",
         'transactions-none' => "There are no transactions for this account.",
         'when-below' => "when account balance is below",
     ],
 ];
diff --git a/src/resources/lang/en/validation.php b/src/resources/lang/en/validation.php
index 05fc3603..30fab367 100644
--- a/src/resources/lang/en/validation.php
+++ b/src/resources/lang/en/validation.php
@@ -1,203 +1,204 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines contain the default error messages used by
     | the validator class. Some of these rules have multiple versions such
     | as the size rules. Feel free to tweak each of these messages here.
     |
     */
 
     'accepted' => 'The :attribute must be accepted.',
     'accepted_if' => 'The :attribute must be accepted when :other is :value.',
     'active_url' => 'The :attribute is not a valid URL.',
     'after' => 'The :attribute must be a date after :date.',
     'after_or_equal' => 'The :attribute must be a date after or equal to :date.',
     'alpha' => 'The :attribute must only contain letters.',
     'alpha_dash' => 'The :attribute must only contain letters, numbers, dashes and underscores.',
     'alpha_num' => 'The :attribute must only contain letters and numbers.',
     'array' => 'The :attribute must be an array.',
     'before' => 'The :attribute must be a date before :date.',
     'before_or_equal' => 'The :attribute must be a date before or equal to :date.',
     'between' => [
         'numeric' => 'The :attribute must be between :min and :max.',
         'file' => 'The :attribute must be between :min and :max kilobytes.',
         'string' => 'The :attribute must be between :min and :max characters.',
         'array' => 'The :attribute must have between :min and :max items.',
     ],
     'boolean' => 'The :attribute field must be true or false.',
     'confirmed' => 'The :attribute confirmation does not match.',
     'current_password' => 'The password is incorrect.',
     'date' => 'The :attribute is not a valid date.',
     'date_equals' => 'The :attribute must be a date equal to :date.',
     'date_format' => 'The :attribute does not match the format :format.',
     'declined' => 'The :attribute must be declined.',
     'declined_if' => 'The :attribute must be declined when :other is :value.',
     'different' => 'The :attribute and :other must be different.',
     'digits' => 'The :attribute must be :digits digits.',
     'digits_between' => 'The :attribute must be between :min and :max digits.',
     'dimensions' => 'The :attribute has invalid image dimensions.',
     'distinct' => 'The :attribute field has a duplicate value.',
     'email' => 'The :attribute must be a valid email address.',
     'ends_with' => 'The :attribute must end with one of the following: :values',
     'enum' => 'The selected :attribute is invalid.',
     'exists' => 'The selected :attribute is invalid.',
     'file' => 'The :attribute must be a file.',
     'filled' => 'The :attribute field must have a value.',
     'gt' => [
         'numeric' => 'The :attribute must be greater than :value.',
         'file' => 'The :attribute must be greater than :value kilobytes.',
         'string' => 'The :attribute must be greater than :value characters.',
         'array' => 'The :attribute must have more than :value items.',
     ],
     'gte' => [
         'numeric' => 'The :attribute must be greater than or equal :value.',
         'file' => 'The :attribute must be greater than or equal :value kilobytes.',
         'string' => 'The :attribute must be greater than or equal :value characters.',
         'array' => 'The :attribute must have :value items or more.',
     ],
     'image' => 'The :attribute must be an image.',
     'in' => 'The selected :attribute is invalid.',
     'in_array' => 'The :attribute field does not exist in :other.',
     'integer' => 'The :attribute must be an integer.',
     'ip' => 'The :attribute must be a valid IP address.',
     'ipv4' => 'The :attribute must be a valid IPv4 address.',
     'ipv6' => 'The :attribute must be a valid IPv6 address.',
     'json' => 'The :attribute must be a valid JSON string.',
     'lt' => [
         'numeric' => 'The :attribute must be less than :value.',
         'file' => 'The :attribute must be less than :value kilobytes.',
         'string' => 'The :attribute must be less than :value characters.',
         'array' => 'The :attribute must have less than :value items.',
     ],
     'lte' => [
         'numeric' => 'The :attribute must be less than or equal :value.',
         'file' => 'The :attribute must be less than or equal :value kilobytes.',
         'string' => 'The :attribute must be less than or equal :value characters.',
         'array' => 'The :attribute must not have more than :value items.',
     ],
     'max' => [
         'numeric' => 'The :attribute may not be greater than :max.',
         'file' => 'The :attribute may not be greater than :max kilobytes.',
         'string' => 'The :attribute may not be greater than :max characters.',
         'array' => 'The :attribute may not have more than :max items.',
     ],
     'mac_address' => 'The :attribute must be a valid MAC address.',
     'mimes' => 'The :attribute must be a file of type: :values.',
     'mimetypes' => 'The :attribute must be a file of type: :values.',
     'min' => [
         'numeric' => 'The :attribute must be at least :min.',
         'file' => 'The :attribute must be at least :min kilobytes.',
         'string' => 'The :attribute must be at least :min characters.',
         'array' => 'The :attribute must have at least :min items.',
     ],
     'multiple_of' => 'The :attribute must be a multiple of :value.',
     'not_in' => 'The selected :attribute is invalid.',
     'not_regex' => 'The :attribute format is invalid.',
     'numeric' => 'The :attribute must be a number.',
     'present' => 'The :attribute field must be present.',
     'prohibited' => 'The :attribute field is prohibited.',
     'prohibited_if' => 'The :attribute field is prohibited when :other is :value.',
     'prohibited_unless' => 'The :attribute field is prohibited unless :other is in :values.',
     'prohibits' => 'The :attribute field prohibits :other from being present.',
     'regex' => 'The :attribute format is invalid.',
     'required' => 'The :attribute field is required.',
     'required_array_keys' => 'The :attribute field must contain entries for: :values.',
     'required_if' => 'The :attribute field is required when :other is :value.',
     'required_unless' => 'The :attribute field is required unless :other is in :values.',
     'required_with' => 'The :attribute field is required when :values is present.',
     'required_with_all' => 'The :attribute field is required when :values are present.',
     'required_without' => 'The :attribute field is required when :values is not present.',
     'required_without_all' => 'The :attribute field is required when none of :values are present.',
     'same' => 'The :attribute and :other must match.',
     'size' => [
         'numeric' => 'The :attribute must be :size.',
         'file' => 'The :attribute must be :size kilobytes.',
         'string' => 'The :attribute must be :size characters.',
         'array' => 'The :attribute must contain :size items.',
     ],
     'starts_with' => 'The :attribute must start with one of the following: :values',
     'string' => 'The :attribute must be a string.',
     'timezone' => 'The :attribute must be a valid timezone.',
     'unique' => 'The :attribute has already been taken.',
     'uploaded' => 'The :attribute failed to upload.',
     'url' => 'The :attribute must be a valid URL.',
     'uuid' => 'The :attribute must be a valid UUID.',
 
     '2fareq' => 'Second factor code is required.',
     '2fainvalid' => 'Second factor code is invalid.',
     'emailinvalid' => 'The specified email address is invalid.',
     'domaininvalid' => 'The specified domain is invalid.',
     'domainnotavailable' => 'The specified domain is not available.',
     'logininvalid' => 'The specified login is invalid.',
     'loginexists' => 'The specified login is not available.',
     'domainexists' => 'The specified domain is not available.',
     'noemailorphone' => 'The specified text is neither a valid email address nor a phone number.',
     'packageinvalid' => 'Invalid package selected.',
     'packagerequired' => 'Package is required.',
     'usernotexists' => 'Unable to find user.',
     'voucherinvalid' => 'The voucher code is invalid or expired.',
     'noextemail' => 'This user has no external email address.',
     'entryinvalid' => 'The specified :attribute is invalid.',
     'entryexists' => 'The specified :attribute is not available.',
     'minamount' => 'Minimum amount for a single payment is :amount.',
     'minamountdebt' => 'The specified amount does not cover the balance on the account.',
     'notalocaluser' => 'The specified email address does not exist.',
     'memberislist' => 'A recipient cannot be the same as the list address.',
     'listmembersrequired' => 'At least one recipient is required.',
     'spf-entry-invalid' => 'The entry format is invalid. Expected a domain name starting with a dot.',
     'sp-entry-invalid' => 'The entry format is invalid. Expected an email, domain, or part of it.',
     'acl-entry-invalid' => 'The entry format is invalid. Expected an email address.',
     'acl-permission-invalid' => 'The specified permission is invalid.',
     'file-perm-exists' => 'File permission already exists.',
     'file-perm-invalid' => 'The file permission is invalid.',
     'file-name-exists' => 'The file name already exists.',
     'file-name-invalid' => 'The file name is invalid.',
     'file-name-toolong' => 'The file name is too long.',
     'geolockinerror' => 'The request location is not allowed.',
     'ipolicy-invalid' => 'The specified invitation policy is invalid.',
     'invalid-config-parameter' => 'The requested configuration parameter is not supported.',
     'nameexists' => 'The specified name is not available.',
     'nameinvalid' => 'The specified name is invalid.',
     'password-policy-error' => 'Specified password does not comply with the policy.',
     'invalid-limit-geo' => 'Specified configuration is invalid. Expected a list of two-letter country codes.',
     'invalid-password-policy' => 'Specified password policy is invalid.',
     'password-policy-min-len-error' => 'Minimum password length cannot be less than :min.',
     'password-policy-max-len-error' => 'Maximum password length cannot be more than :max.',
     'password-policy-last-error' => 'The minimum value for last N passwords is :last.',
+    'signuptokeninvalid' => 'The signup token is invalid.',
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | Here you may specify custom validation messages for attributes using the
     | convention "attribute.rule" to name the lines. This makes it quick to
     | specify a specific custom language line for a given attribute rule.
     |
     */
 
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',
         ],
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Attributes
     |--------------------------------------------------------------------------
     |
     | The following language lines are used to swap our attribute placeholder
     | with something more reader friendly such as "E-Mail Address" instead
     | of "email". This simply helps us make our message more expressive.
     |
     */
 
     'attributes' => [],
 ];
diff --git a/src/resources/themes/app.scss b/src/resources/themes/app.scss
index a3f6ab71..5d0a03bd 100644
--- a/src/resources/themes/app.scss
+++ b/src/resources/themes/app.scss
@@ -1,541 +1,541 @@
 html,
 body,
 body > .outer-container {
     height: 100%;
 }
 
 #app {
     display: flex;
     flex-direction: column;
     min-height: 100%;
     overflow: hidden;
 
     & > nav {
         flex-shrink: 0;
         z-index: 12;
     }
 
     & > div.container {
         flex-grow: 1;
         margin-top: 2rem;
         margin-bottom: 2rem;
     }
 
     & > .filler {
         flex-grow: 1;
     }
 
     & > div.container + .filler {
         display: none;
     }
 }
 
 .error-page {
     position: absolute;
     top: 0;
     height: 100%;
     width: 100%;
     align-content: center;
     align-items: center;
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
     color: #636b6f;
     z-index: 10;
     background: white;
 
     .code {
         text-align: right;
         border-right: 2px solid;
         font-size: 26px;
         padding: 0 15px;
     }
 
     .message {
         font-size: 18px;
         padding: 0 15px;
     }
 
     .hint {
         margin-top: 3em;
         text-align: center;
         width: 100%;
     }
 }
 
 .app-loader {
     background-color: $body-bg;
     height: 100%;
     width: 100%;
     position: absolute;
     top: 0;
     left: 0;
     display: flex;
     align-items: center;
     justify-content: center;
     z-index: 8;
 
     .spinner-border {
         width: 120px;
         height: 120px;
         border-width: 15px;
         color: #b2aa99;
     }
 
     &.small .spinner-border {
         width: 25px;
         height: 25px;
         border-width: 3px;
     }
 
     &.fadeOut {
         visibility: hidden;
         opacity: 0;
         transition: visibility 300ms linear, opacity 300ms linear;
     }
 }
 
 pre {
     margin: 1rem 0;
     padding: 1rem;
     background-color: $menu-bg-color;
 }
 
 .card-title {
     font-size: 1.2rem;
     font-weight: bold;
 }
 
 tfoot.table-fake-body {
     background-color: #f8f8f8;
     color: grey;
     text-align: center;
 
     td {
         vertical-align: middle;
         height: 8em;
         border: 0;
     }
 
     tbody:not(:empty) + & {
         display: none;
     }
 }
 
 table {
     th {
         white-space: nowrap;
     }
 
     td .btn-link {
         vertical-align: initial;
     }
 
     td.email,
     td.price,
     td.datetime,
     td.selection {
         width: 1%;
         white-space: nowrap;
     }
 
     td.buttons,
     th.price,
     td.price,
     th.size,
     td.size {
         width: 1%;
         text-align: right;
         white-space: nowrap;
     }
 
     &.form-list {
         margin: 0;
 
         td {
             border: 0;
 
             &:first-child {
                 padding-left: 0;
             }
 
             &:last-child {
                 padding-right: 0;
             }
         }
 
         button {
             line-height: 1;
         }
     }
 
     .btn-action {
         line-height: 1;
         padding: 0;
     }
 
     &.files {
         table-layout: fixed;
 
         td {
             white-space: nowrap;
         }
 
         td.name {
             overflow: hidden;
             text-overflow: ellipsis;
         }
 /*
         td.size,
         th.size {
             width: 80px;
         }
 
         td.mtime,
         th.mtime {
             width: 140px;
 
             @include media-breakpoint-down(sm) {
                 display: none;
             }
         }
 */
         td.buttons,
         th.buttons {
             width: 50px;
         }
     }
 }
 
 .table > :not(:first-child) {
     // Remove Bootstrap's 2px border
     border-width: 0;
 }
 
 .list-details {
     min-height: 1em;
 
     & > ul {
         margin: 0;
         padding-left: 1.2em;
     }
 }
 
 .plan-selector {
     .plan-header {
         display: flex;
     }
 
     .plan-ico {
         margin:auto;
         font-size: 3.8rem;
-        color: #f1a539;
-        border: 3px solid #f1a539;
+        color: $main-color;
+        border: 3px solid $main-color;
         width: 6rem;
         height: 6rem;
         border-radius: 50%;
     }
 }
 
 .status-message {
     display: flex;
     align-items: center;
     justify-content: center;
 
     .app-loader {
         width: auto;
         position: initial;
 
         .spinner-border {
             color: $body-color;
         }
     }
 
     svg {
         font-size: 1.5em;
     }
 
     :first-child {
         margin-right: 0.4em;
     }
 }
 
 .form-separator {
     position: relative;
     margin: 1em 0;
     display: flex;
     justify-content: center;
 
     hr {
         border-color: #999;
         margin: 0;
         position: absolute;
         top: 0.75em;
         width: 100%;
     }
 
     span {
         background: #fff;
         padding: 0 1em;
         z-index: 1;
     }
 }
 
 .modal {
     .modal-dialog,
     .modal-content {
         max-height: calc(100vh - 3.5rem);
     }
 
     .modal-body {
         overflow: auto !important;
     }
 
     &.fullscreen {
         .modal-dialog {
             height: 100%;
             width: 100%;
             max-width: calc(100vw - 1rem);
         }
 
         .modal-content {
             height: 100%;
             max-height: 100% !important;
         }
 
         .modal-body {
             padding: 0;
             margin: 1em;
             overflow: hidden !important;
         }
     }
 }
 
 #status-box {
     background-color: lighten($green, 35);
 
     .progress {
         background-color: #fff;
         height: 10px;
     }
 
     .progress-label {
         font-size: 0.9em;
     }
 
     .progress-bar {
         background-color: $green;
     }
 
     &.process-failed {
         background-color: lighten($orange, 30);
 
         .progress-bar {
             background-color: $red;
         }
     }
 }
 
 @keyframes blinker {
     50% {
         opacity: 0;
     }
 }
 
 .blinker {
     animation: blinker 750ms step-start infinite;
 }
 
 #dashboard-nav {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
 
         &.disabled {
             pointer-events: none;
             opacity: 0.6;
         }
 
         // Some icons are too big, scale them down
         &.link-companionapp,
         &.link-domains,
         &.link-resources,
         &.link-settings,
         &.link-wallet,
         &.link-invitations {
             svg {
                 transform: scale(0.8);
             }
         }
 
         &.link-distlists,
         &.link-files,
         &.link-shared-folders {
             svg {
                 transform: scale(0.9);
             }
         }
 
         .badge {
             position: absolute;
             top: 0.5rem;
             right: 0.5rem;
         }
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 }
 
 #payment-method-selection {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 
     .link-banktransfer svg {
         transform: scale(.8);
     }
 }
 
 #logon-form {
     flex-basis: auto; // Bootstrap issue? See logon page with width < 992
 }
 
 #logon-form-footer {
     a:not(:first-child) {
         margin-left: 2em;
     }
 }
 
 // Various improvements for mobile
 @include media-breakpoint-down(sm) {
     .card,
     .card-footer {
         border: 0;
     }
 
     .card-body {
         padding: 0.5rem 0;
     }
 
     .nav-tabs {
         flex-wrap: nowrap;
 
         .nav-link {
             white-space: nowrap;
             padding: 0.5rem 0.75rem;
         }
     }
 
     #app > div.container {
         margin-bottom: 1rem;
         margin-top: 1rem;
         max-width: 100%;
     }
 
     #header-menu-navbar {
         padding: 0;
     }
 
     #dashboard-nav > a {
         width: 135px;
     }
 
     .table-sm:not(.form-list) {
         tbody td {
             padding: 0.75rem 0.5rem;
 
             svg {
                 vertical-align: -0.175em;
             }
 
             & > svg {
                 font-size: 125%;
                 margin-right: 0.25rem;
             }
         }
     }
 
     .table.transactions {
         thead {
             display: none;
         }
 
         tbody {
             tr {
                 position: relative;
                 display: flex;
                 flex-wrap: wrap;
             }
 
             td {
                 width: auto;
                 border: 0;
                 padding: 0.5rem;
 
                 &.datetime {
                     width: 50%;
                     padding-left: 0;
                 }
 
                 &.description {
                     order: 3;
                     width: 100%;
                     border-bottom: 1px solid $border-color;
                     color: $secondary;
                     padding: 0 1.5em 0.5rem 0;
                     margin-top: -0.25em;
                 }
 
                 &.selection {
                     position: absolute;
                     right: 0;
                     border: 0;
                     top: 1.7em;
                     padding-right: 0;
                 }
 
                 &.price {
                     width: 50%;
                     padding-right: 0;
                 }
 
                 &.email {
                     display: none;
                 }
             }
         }
     }
 }
 
 @include media-breakpoint-down(sm) {
     .tab-pane > .card-body {
         padding: 0.5rem;
     }
 }
diff --git a/src/resources/vue/Signup.vue b/src/resources/vue/Signup.vue
index 2020ece7..6de99268 100644
--- a/src/resources/vue/Signup.vue
+++ b/src/resources/vue/Signup.vue
@@ -1,299 +1,338 @@
 <template>
     <div class="container">
         <div id="step0" v-if="!invitation">
             <div class="plan-selector row row-cols-sm-2 g-3">
                 <div v-for="item in plans" :key="item.id">
                     <div :class="'card bg-light plan-' + item.title">
                         <div class="card-header plan-header">
                             <div class="plan-ico text-center">
                                 <svg-icon :icon="plan_icons[item.title]"></svg-icon>
                             </div>
                         </div>
                         <div class="card-body text-center">
                             <btn class="btn-primary" :data-title="item.title" @click="selectPlan(item.title)" v-html="item.button"></btn>
                             <div class="plan-description text-start mt-3" v-html="item.description"></div>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
 
         <div class="card d-none" id="step1" v-if="!invitation">
             <div class="card-body">
-                <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 1, n: 3 }) }}</h4>
+                <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 1, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step1') }}
                 </p>
                 <form @submit.prevent="submitStep1" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
-                    <div class="mb-3">
+                    <div v-if="mode == 'token'" class="mb-3">
+                        <label for="signup_token" class="visually-hidden">{{ $t('signup.token') }}</label>
+                        <input type="text" class="form-control" id="signup_token" :placeholder="$t('signup.token')" required v-model="token">
+                    </div>
+                    <div v-else class="mb-3">
                         <label for="signup_email" class="visually-hidden">{{ $t('signup.email') }}</label>
                         <input type="text" class="form-control" id="signup_email" :placeholder="$t('signup.email')" required v-model="email">
                     </div>
                     <btn class="btn-secondary" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary ms-2" type="submit" icon="check">{{ $t('btn.continue') }}</btn>
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step2" v-if="!invitation">
             <div class="card-body">
-                <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 2, n: 3 }) }}</h4>
+                <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 2, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step2') }}
                 </p>
                 <form @submit.prevent="submitStep2" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <label for="signup_short_code" class="visually-hidden">{{ $t('form.code') }}</label>
                         <input type="text" class="form-control" id="signup_short_code" :placeholder="$t('form.code')" required v-model="short_code">
                     </div>
                     <btn class="btn-secondary" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary ms-2" type="submit" icon="check">{{ $t('btn.continue') }}</btn>
                     <input type="hidden" id="signup_code" v-model="code" />
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step3">
             <div class="card-body">
-                <h4 v-if="!invitation" class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 3, n: 3 }) }}</h4>
+                <h4 v-if="!invitation" class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: steps, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step3') }}
                 </p>
                 <form @submit.prevent="submitStep3" data-validation-prefix="signup_">
                     <div class="mb-3" v-if="invitation">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
                     <div class="mb-3">
                         <label for="signup_login" class="visually-hidden"></label>
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_login" required v-model="login" :placeholder="$t('signup.login')">
                             <span class="input-group-text">@</span>
                             <input v-if="is_domain" type="text" class="form-control rounded-end" id="signup_domain" required v-model="domain" :placeholder="$t('form.domain')">
                             <select v-else class="form-select rounded-end" id="signup_domain" required v-model="domain">
                                 <option v-for="_domain in domains" :key="_domain" :value="_domain">{{ _domain }}</option>
                             </select>
                         </div>
                     </div>
                     <password-input class="mb-3" v-model="pass"></password-input>
                     <div class="mb-3">
                         <label for="signup_voucher" class="visually-hidden">{{ $t('signup.voucher') }}</label>
                         <input type="text" class="form-control" id="signup_voucher" :placeholder="$t('signup.voucher')" v-model="voucher">
                     </div>
                     <btn v-if="!invitation" class="btn-secondary me-2" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary" type="submit" icon="check">
                         <span v-if="invitation">{{ $t('btn.signup') }}</span>
                         <span v-else>{{ $t('btn.submit') }}</span>
                     </btn>
                 </form>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import PasswordInput from './Widgets/PasswordInput'
 
     import { library } from '@fortawesome/fontawesome-svg-core'
 
     library.add(
-        require('@fortawesome/free-solid-svg-icons/faUsers').definition,
+        require('@fortawesome/free-solid-svg-icons/faMobileRetro').definition,
+        require('@fortawesome/free-solid-svg-icons/faUsers').definition
     )
 
     export default {
         components: {
             PasswordInput
         },
         data() {
             return {
                 email: '',
                 first_name: '',
                 last_name: '',
                 code: '',
                 short_code: '',
                 login: '',
                 pass: {},
                 domain: '',
                 domains: [],
                 invitation: null,
                 is_domain: false,
+                mode: 'email',
                 plan: null,
                 plan_icons: {
                     individual: 'user',
-                    group: 'users'
+                    group: 'users',
+                    phone: 'mobile-retro'
                 },
                 plans: [],
+                token: '',
                 voucher: ''
             }
         },
+        computed: {
+            steps() {
+                return this.mode == 'token' ? 2 : 3
+            }
+        },
         mounted() {
             let param = this.$route.params.param;
 
             if (this.$route.name == 'signup-invite') {
                 axios.get('/api/auth/signup/invitations/' + param, { loader: true })
                     .then(response => {
                         this.invitation = response.data
                         this.login = response.data.login
                         this.voucher = response.data.voucher
                         this.first_name = response.data.first_name
                         this.last_name = response.data.last_name
                         this.plan = response.data.plan
                         this.is_domain = response.data.is_domain
                         this.setDomain(response.data)
                         this.displayForm(3, true)
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
             } else if (param) {
                 if (this.$route.path.indexOf('/signup/voucher/') === 0) {
                     // Voucher (discount) code
                     this.voucher = param
                     this.displayForm(0)
                 } else if (/^([A-Z0-9]+)-([a-zA-Z0-9]+)$/.test(param)) {
                     // Verification code provided, auto-submit Step 2
                     this.short_code = RegExp.$1
                     this.code = RegExp.$2
                     this.submitStep2(true)
                 } else if (/^([a-zA-Z_]+)$/.test(param)) {
                     // Plan title provided, save it and display Step 1
-                    this.plan = param
-                    this.displayForm(1, true)
+                    this.step0(param)
                 } else {
                     this.$root.errorPage(404)
                 }
             } else {
                 this.displayForm(0)
             }
         },
         methods: {
             selectPlan(plan) {
                 this.$router.push({path: '/signup/' + plan})
-                this.plan = plan
-                this.displayForm(1, true)
+                this.selectPlanByTitle(plan)
             },
             // Composes plan selection page
-            step0() {
+            selectPlanByTitle(title) {
+                const plan = this.plans.filter(plan => plan.title == title)[0]
+                if (plan) {
+                    this.plan = title
+                    this.mode = plan.mode
+                    this.displayForm(1, true)
+                }
+            },
+            step0(plan) {
                 if (!this.plans.length) {
                     axios.get('/api/auth/signup/plans', { loader: true }).then(response => {
                         this.plans = response.data.plans
+                        this.selectPlanByTitle(plan)
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
+                } else {
+                    this.selectPlanByTitle(plan)
                 }
             },
             // Submits data to the API, validates and gets verification code
             submitStep1() {
                 this.$root.clearFormValidation($('#step1 form'))
 
-                const post = this.$root.pick(this, ['email', 'last_name', 'first_name', 'plan', 'voucher'])
+                const post = this.$root.pick(this, ['email', 'last_name', 'first_name', 'plan', 'token', 'voucher'])
 
                 axios.post('/api/auth/signup/init', post)
                     .then(response => {
-                        this.displayForm(2, true)
                         this.code = response.data.code
+                        this.short_code = response.data.short_code
+                        this.mode = response.data.mode
+                        this.is_domain = response.data.is_domain
+                        this.displayForm(this.mode == 'token' ? 3 : 2, true)
+
+                        // Fill the domain selector with available domains
+                        if (!this.is_domain) {
+                            this.setDomain(response.data)
+                        }
                     })
             },
             // Submits the code to the API for verification
             submitStep2(bylink) {
                 if (bylink === true) {
                     this.displayForm(2, false)
                 }
 
                 this.$root.clearFormValidation($('#step2 form'))
 
                 const post = this.$root.pick(this, ['code', 'short_code'])
 
                 axios.post('/api/auth/signup/verify', post)
                     .then(response => {
                         this.displayForm(3, true)
                         // Reset user name/email/plan, we don't have them if user used a verification link
                         this.first_name = response.data.first_name
                         this.last_name = response.data.last_name
                         this.email = response.data.email
                         this.is_domain = response.data.is_domain
                         this.voucher = response.data.voucher
+                        this.domain = ''
 
                         // Fill the domain selector with available domains
                         if (!this.is_domain) {
                             this.setDomain(response.data)
                         }
                     })
                     .catch(error => {
                         if (bylink === true) {
                             // FIXME: display step 1, user can do nothing about it anyway
                             //        Maybe we should display 404 error page?
                             this.displayForm(1, true)
                         }
                     })
             },
             // Submits the data to the API to create the user account
             submitStep3() {
                 this.$root.clearFormValidation($('#step3 form'))
 
                 let post = {
                     ...this.$root.pick(this, ['login', 'domain', 'voucher']),
                     ...this.pass
                 }
 
                 if (this.invitation) {
                     post.invitation = this.invitation.id
                     post.plan = this.plan
                     post.first_name = this.first_name
                     post.last_name = this.last_name
                 } else {
                     post.code = this.code
                     post.short_code = this.short_code
                 }
 
                 axios.post('/api/auth/signup', post).then(response => {
                     // auto-login and goto dashboard
                     this.$root.loginUser(response.data)
                 })
             },
             // Moves the user a step back in registration form
             stepBack(e) {
-                var card = $(e.target).closest('.card')
+                const card = $(e.target).closest('.card')
+                let step = card.attr('id').replace('step', '')
 
-                card.prev().removeClass('d-none').find('input').first().focus()
                 card.addClass('d-none').find('form')[0].reset()
 
-                if (card.attr('id') == 'step1') {
+                step -= 1
+
+                if (step == 2 && this.mode == 'token') {
+                    step = 1
+                }
+
+                $('#step' + step).removeClass('d-none').find('input').first().focus()
+
+                if (!step) {
                     this.step0()
                     this.$router.replace({path: '/signup'})
                 }
             },
             displayForm(step, focus) {
                 [0, 1, 2, 3].filter(value => value != step).forEach(value => {
                     $('#step' + value).addClass('d-none')
                 })
 
                 if (!step) {
                     return this.step0()
                 }
 
-                $('#step' + step).removeClass('d-none')
+                $('#step' + step).removeClass('d-none').find('form')[0].reset()
 
                 if (focus) {
                     $('#step' + step).find('input').first().focus()
                 }
             },
             setDomain(response) {
                 if (response.domains) {
                     this.domains = response.domains
                 }
 
                 this.domain = response.domain || window.config['app.domain']
             }
         }
     }
 </script>
diff --git a/src/tests/Browser/SignupTest.php b/src/tests/Browser/SignupTest.php
index 4d8c9d7a..342d962f 100644
--- a/src/tests/Browser/SignupTest.php
+++ b/src/tests/Browser/SignupTest.php
@@ -1,652 +1,765 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Domain;
+use App\Plan;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Signup;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class SignupTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
+
+        Plan::where('mode', 'token')->update(['mode' => 'email']);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
         SignupInvitation::truncate();
 
+        Plan::where('mode', 'token')->update(['mode' => 'email']);
+
+        @unlink(storage_path('signup-tokens.txt'));
+
         parent::tearDown();
     }
 
     /**
      * Test signup code verification with a link
      */
     public function testSignupCodeByLink(): void
     {
         // Test invalid code (invalid format)
         $this->browse(function (Browser $browser) {
             // Register Signup page element selectors we'll be using
             $browser->onWithoutAssert(new Signup());
 
             // TODO: Test what happens if user is logged in
 
             $browser->visit('/signup/invalid-code');
 
             // TODO: According to https://github.com/vuejs/vue-router/issues/977
             // it is not yet easily possible to display error page component (route)
             // without changing the URL
             // TODO: Instead of css selector we should probably define page/component
             // and use it instead
             $browser->waitFor('#error-page');
         });
 
         // Test invalid code (valid format)
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/XXXXX-code');
 
             // FIXME: User will not be able to continue anyway, so we should
             //        either display 1st step or 404 error page
             $browser->waitFor('@step1')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
         });
 
         // Test valid code
         $this->browse(function (Browser $browser) {
             $code = SignupCode::create([
                     'email' => 'User@example.org',
                     'first_name' => 'User',
                     'last_name' => 'Name',
                     'plan' => 'individual',
                     'voucher' => '',
             ]);
 
             $browser->visit('/signup/' . $code->short_code . '-' . $code->code)
                 ->waitFor('@step3')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2');
 
             // FIXME: Find a nice way to read javascript data without using hidden inputs
             $this->assertSame($code->code, $browser->value('@step2 #signup_code'));
 
             // TODO: Test if the signup process can be completed
         });
     }
 
     /**
      * Test signup "welcome" page
      */
     public function testSignupStep0(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             $browser->assertVisible('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             $browser->waitFor('@step0 .plan-selector .card');
 
             // Assert first plan box and press the button
             $browser->with('@step0 .plan-selector .plan-individual', function ($step) {
                 $step->assertVisible('button')
                     ->assertSeeIn('button', 'Individual Account')
                     ->assertVisible('.plan-description')
                     ->click('button');
             });
 
             $browser->waitForLocation('/signup/individual')
                 ->assertVisible('@step1')
+                ->assertSeeIn('.card-title', 'Sign Up - Step 1/3')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // Click Back button
             $browser->click('@step1 [type=button]')
                 ->waitForLocation('/signup')
                     ->assertVisible('@step0')
                     ->assertMissing('@step1')
                     ->assertMissing('@step2')
                     ->assertMissing('@step3');
 
             // Choose the group account plan
             $browser->click('@step0 .plan-selector .plan-group button')
                 ->waitForLocation('/signup/group')
                 ->assertVisible('@step1')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // TODO: Test if 'plan' variable is set properly in vue component
         });
     }
 
     /**
      * Test 1st step of the signup process
      */
     public function testSignupStep1(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/individual')
                 ->onWithoutAssert(new Signup());
 
             // Here we expect two text inputs and Back and Continue buttons
             $browser->with('@step1', function ($step) {
-                $step->assertVisible('#signup_last_name')
+                $step->waitFor('#signup_last_name')
+                    ->assertSeeIn('.card-title', 'Sign Up - Step 1/3')
                     ->assertVisible('#signup_first_name')
                     ->assertFocused('#signup_first_name')
                     ->assertVisible('#signup_email')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Submit empty form
             // Email is required, so after pressing Submit
             // we expect focus to be moved to the email input
             $browser->with('@step1', function ($step) {
                 $step->click('[type=submit]');
                 $step->assertFocused('#signup_email');
             });
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             // Submit invalid email, and first_name
             // We expect both inputs to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', str_repeat('a', 250))
                     ->type('#signup_email', '@test')
                     ->click('[type=submit]')
                     ->waitFor('#signup_email.is-invalid')
                     ->assertVisible('#signup_first_name.is-invalid')
                     ->assertVisible('#signup_email + .invalid-feedback')
                     ->assertVisible('#signup_last_name + .invalid-feedback')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]')
                     ->assertMissing('#signup_email.is-invalid')
                     ->assertMissing('#signup_email + .invalid-feedback');
             });
 
             $browser->waitUntilMissing('@step2 #signup_code[value=""]');
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
         });
     }
 
     /**
      * Test 2nd Step of the signup process
      *
      * @depends testSignupStep1
      */
     public function testSignupStep2(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step2')
+                ->assertSeeIn('@step2 .card-title', 'Sign Up - Step 2/3')
                 ->assertMissing('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step3');
 
             // Here we expect one text input, Back and Continue buttons
             $browser->with('@step2', function ($step) {
                 $step->assertVisible('#signup_short_code')
                     ->assertFocused('#signup_short_code')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Test Back button functionality
             $browser->click('@step2 [type=button]')
                 ->waitFor('@step1')
                 ->assertFocused('@step1 #signup_first_name')
                 ->assertMissing('@step2');
 
             // Submit valid Step 1 data (again)
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'User')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
 
             // Submit invalid code
             // We expect code input to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step2', function ($step) {
                 $step->type('#signup_short_code', 'XXXXX');
                 $step->click('[type=submit]');
 
                 $step->waitFor('#signup_short_code.is-invalid')
                     ->assertVisible('#signup_short_code + .invalid-feedback')
                     ->assertFocused('#signup_short_code')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid code
             // We expect error state on code input to be removed, and Step 3 form visible
             $browser->with('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
 
                 $step->assertMissing('#signup_short_code.is-invalid');
                 $step->assertMissing('#signup_short_code + .invalid-feedback');
             });
 
             $browser->waitFor('@step3');
             $browser->assertMissing('@step2');
         });
     }
 
     /**
      * Test 3rd Step of the signup process
      *
      * @depends testSignupStep2
      */
     public function testSignupStep3(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step3');
 
             // Here we expect 3 text inputs, Back and Continue buttons
             $browser->with('@step3', function ($step) {
                 $domains = Domain::getPublicDomains();
                 $domains_count = count($domains);
 
                 $step->assertSeeIn('.card-title', 'Sign Up - Step 3/3')
                     ->assertMissing('#signup_last_name')
                     ->assertMissing('#signup_first_name')
                     ->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
                     ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('select#signup_domain')
                     ->assertElementsCount('select#signup_domain option', $domains_count, false)
                     ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertText('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertValue('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertSeeIn('[type=submit]', 'Submit')
                     ->assertFocused('#signup_login')
                     ->assertSelected('select#signup_domain', \config('app.domain'))
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
                     ->assertValue('#signup_password_confirmation', '')
                     ->with('#signup_password_policy', function (Browser $browser) {
                         $browser->assertElementsCount('li', 2)
                             ->assertMissing('li:first-child svg.text-success')
                             ->assertSeeIn('li:first-child small', "Minimum password length: 6 characters")
                             ->assertMissing('li:last-child svg.text-success')
                             ->assertSeeIn('li:last-child small', "Maximum password length: 255 characters");
                     });
 
                 // TODO: Test domain selector
             });
 
             // Test Back button
             $browser->click('@step3 [type=button]');
             $browser->waitFor('@step2');
             $browser->assertFocused('@step2 #signup_short_code');
             $browser->assertMissing('@step3');
 
             // TODO: Test form reset when going back
 
             // Submit valid code again
             $browser->with('@step2', function ($step) {
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
             });
 
             $browser->waitFor('@step3');
 
             // Submit invalid data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '123456789')
                     ->with('#signup_password_policy', function (Browser $browser) {
                         $browser->waitFor('li:first-child svg.text-success')
                             ->waitFor('li:last-child svg.text-success');
                     })
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid data (valid login, invalid password)
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'SignupTestDusk')
                     ->click('[type=submit]')
                     ->waitFor('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertMissing('#signup_login.is-invalid')
                     ->assertMissing('#signup_domain + .invalid-feedback')
                     ->assertFocused('#signup_password')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_password_confirmation', '12345678');
 
                 $step->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 ->assertVisible('@links a.link-profile')
                 ->assertMissing('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             // Logout the user
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
     /**
      * Test signup for a group account
      */
     public function testSignupGroup(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             // Choose the group account plan
             $browser->waitFor('@step0 .plan-group button')
                 ->click('@step0 .plan-group button');
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->whenAvailable('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             // Submit valid code
             $browser->whenAvailable('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code)
                     ->click('[type=submit]');
             });
 
             // Here we expect 4 text inputs, Back and Continue buttons
             $browser->whenAvailable('@step3', function ($step) {
                 $step->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
                     ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('input#signup_domain')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertFocused('#signup_login')
                     ->assertValue('input#signup_domain', '')
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
                     ->assertValue('#signup_password_confirmation', '');
             });
 
             // Submit invalid login and password data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_domain', 'test.com')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '123456789')
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'admin')
                     ->type('#signup_domain', 'aaa')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '12345678')
                     ->click('[type=submit]')
                     ->waitUntilMissing('#signup_login.is-invalid')
                     ->waitFor('#signup_domain.is-invalid + .invalid-feedback')
                     ->assertMissing('#signup_password.is-invalid')
                     ->assertMissing('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_domain')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_domain', 'user-domain-signup.com')
                     ->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('admin@user-domain-signup.com')
                 ->assertVisible('@links a.link-profile')
                 ->assertVisible('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
+    /**
+     * Test signup with a token plan
+     */
+    public function testSignupToken(): void
+    {
+        // Test the individual plan
+        Plan::where('title', 'individual')->update(['mode' => 'token']);
+
+        // Register some valid tokens
+        $tokens = ['1234567890', 'abcdefghijk'];
+        file_put_contents(storage_path('signup-tokens.txt'), implode("\n", $tokens));
+
+        $this->browse(function (Browser $browser) use ($tokens) {
+            $browser->visit(new Signup())
+                ->waitFor('@step0 .plan-individual button')
+                ->click('@step0 .plan-individual button')
+                // Step 1
+                ->whenAvailable('@step1', function ($browser) use ($tokens) {
+                    $browser->assertSeeIn('.card-title', 'Sign Up - Step 1/2')
+                        ->type('#signup_first_name', 'Test')
+                        ->type('#signup_last_name', 'User')
+                        ->assertMissing('#signup_email')
+                        ->type('#signup_token', '1234')
+                        // invalid token
+                        ->click('[type=submit]')
+                        ->waitFor('#signup_token.is-invalid')
+                        ->assertVisible('#signup_token + .invalid-feedback')
+                        ->assertFocused('#signup_token')
+                        ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
+                        // valid token
+                        ->type('#signup_token', $tokens[0])
+                        ->click('[type=submit]');
+                })
+                // Step 2
+                ->whenAvailable('@step3', function ($browser) {
+                    $domains = Domain::getPublicDomains();
+                    $domains_count = count($domains);
+
+                    $browser->assertSeeIn('.card-title', 'Sign Up - Step 2/2')
+                        ->assertElementsCount('select#signup_domain option', $domains_count, false)
+                        ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
+                        ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
+                        ->type('#signup_login', 'signuptestdusk')
+                        ->type('#signup_password', '12345678')
+                        ->type('#signup_password_confirmation', '12345678')
+                        ->click('[type=submit]');
+                })
+                ->waitUntilMissing('@step3')
+                ->on(new Dashboard())
+                ->within(new Menu(), function ($browser) {
+                    $browser->clickMenuItem('logout');
+                });
+        });
+
+        $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
+        $this->assertSame($tokens[0], $user->getSetting('signup_token'));
+        $this->assertSame(null, $user->getSetting('external_email'));
+
+        // Test the group plan
+        Plan::where('title', 'group')->update(['mode' => 'token']);
+
+        $this->browse(function (Browser $browser) use ($tokens) {
+            $browser->visit(new Signup())
+                ->waitFor('@step0 .plan-group button')
+                ->click('@step0 .plan-group button')
+                // Step 1
+                ->whenAvailable('@step1', function ($browser) use ($tokens) {
+                    $browser->assertSeeIn('.card-title', 'Sign Up - Step 1/2')
+                        ->type('#signup_first_name', 'Test')
+                        ->type('#signup_last_name', 'User')
+                        ->assertMissing('#signup_email')
+                        ->type('#signup_token', '1234')
+                        // invalid token
+                        ->click('[type=submit]')
+                        ->waitFor('#signup_token.is-invalid')
+                        ->assertVisible('#signup_token + .invalid-feedback')
+                        ->assertFocused('#signup_token')
+                        ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
+                        // valid token
+                        ->type('#signup_token', $tokens[1])
+                        ->click('[type=submit]');
+                })
+                // Step 2
+                ->whenAvailable('@step3', function ($browser) {
+                    $browser->assertSeeIn('.card-title', 'Sign Up - Step 2/2')
+                        ->type('input#signup_domain', 'user-domain-signup.com')
+                        ->type('#signup_login', 'admin')
+                        ->type('#signup_password', '12345678')
+                        ->type('#signup_password_confirmation', '12345678')
+                        ->click('[type=submit]');
+                })
+                ->waitUntilMissing('@step3')
+                ->on(new Dashboard())
+                ->within(new Menu(), function ($browser) {
+                    $browser->clickMenuItem('logout');
+                });
+        });
+
+        $user = User::where('email', 'admin@user-domain-signup.com')->first();
+        $this->assertSame($tokens[1], $user->getSetting('signup_token'));
+        $this->assertSame(null, $user->getSetting('external_email'));
+    }
+
     /**
      * Test signup with voucher
      */
     public function testSignupVoucherLink(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/voucher/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->waitFor('@step0')
                 ->click('.plan-individual button')
                 ->whenAvailable('@step1', function (Browser $browser) {
                     $browser->type('#signup_first_name', 'Test')
                         ->type('#signup_last_name', 'User')
                         ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step2', function (Browser $browser) {
                     // Get the code and short_code from database
                     // FIXME: Find a nice way to read javascript data without using hidden inputs
                     $code = $browser->value('#signup_code');
 
                     $this->assertNotEmpty($code);
 
                     $code = SignupCode::find($code);
 
                     $browser->type('#signup_short_code', $code->short_code)
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step3', function (Browser $browser) {
                     // Assert that the code is filled in the input
                     // Change it and test error handling
                     $browser->assertValue('#signup_voucher', 'TEST')
                         ->type('#signup_voucher', 'TESTXX')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_password', '123456789')
                         ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_voucher.is-invalid')
                         ->assertVisible('#signup_voucher + .invalid-feedback')
                         ->assertFocused('#signup_voucher')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         // Submit the correct code
                         ->type('#signup_voucher', 'TEST')
                         ->click('[type=submit]');
                 })
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $user = $this->getTestUser('signuptestdusk@' . \config('app.domain'));
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
     }
 
     /**
      * Test signup via invitation link
      */
     public function testSignupInvitation(): void
     {
         // Test non-existing invitation
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/invite/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitFor('#app > #error-page')
                 ->assertErrorPage(404);
         });
 
         $invitation = SignupInvitation::create(['email' => 'test@domain.org']);
 
         $this->browse(function (Browser $browser) use ($invitation) {
             $browser->visit('/signup/invite/' . $invitation->id)
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->with('@step3', function ($step) {
                     $domains_count = count(Domain::getPublicDomains());
 
                     $step->assertMissing('.card-title')
                         ->assertVisible('#signup_last_name')
                         ->assertVisible('#signup_first_name')
                         ->assertVisible('#signup_login')
                         ->assertVisible('#signup_password')
                         ->assertVisible('#signup_password_confirmation')
                         ->assertVisible('select#signup_domain')
                         ->assertElementsCount('select#signup_domain option', $domains_count, false)
                         ->assertVisible('[type=submit]')
                         ->assertMissing('[type=button]') // Back button
                         ->assertSeeIn('[type=submit]', 'Sign Up')
                         ->assertFocused('#signup_first_name')
                         ->assertValue('select#signup_domain', \config('app.domain'))
                         ->assertValue('#signup_first_name', '')
                         ->assertValue('#signup_last_name', '')
                         ->assertValue('#signup_login', '')
                         ->assertValue('#signup_password', '')
                         ->assertValue('#signup_password_confirmation', '');
 
                     // Submit invalid data
                     $step->type('#signup_login', '*')
                         ->type('#signup_password', '12345678')
                         ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_login.is-invalid')
                         ->assertVisible('#signup_domain + .invalid-feedback')
                         ->assertVisible('#signup_password.is-invalid')
                         ->assertVisible('#signup_password_input .invalid-feedback')
                         ->assertFocused('#signup_login')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // Submit valid data
                     $step->type('#signup_password_confirmation', '12345678')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_first_name', 'First')
                         ->type('#signup_last_name', 'Last')
                         ->click('[type=submit]');
                 })
                 // At this point we should be auto-logged-in to dashboard
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $invitation->refresh();
         $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
 
         $this->assertTrue($invitation->isCompleted());
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertSame('First', $user->getSetting('first_name'));
         $this->assertSame('Last', $user->getSetting('last_name'));
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
     }
 }
diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
index 54efe6ff..a2345bc8 100644
--- a/src/tests/Feature/Controller/SignupTest.php
+++ b/src/tests/Feature/Controller/SignupTest.php
@@ -1,890 +1,894 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\SignupController;
 use App\Discount;
 use App\Domain;
 use App\SignupCode;
 use App\SignupInvitation as SI;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class SignupTest extends TestCase
 {
     private $domain;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // TODO: Some tests depend on existence of individual and group plans,
         //       we should probably create plans here to not depend on that
         $this->domain = $this->getPublicDomain();
 
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
 
         parent::tearDown();
     }
 
     /**
      * Return a public domain for signup tests
      */
     private function getPublicDomain(): string
     {
         if (!$this->domain) {
             $this->refreshApplication();
             $public_domains = Domain::getPublicDomains();
             $this->domain = reset($public_domains);
 
             if (empty($this->domain)) {
                 $this->domain = 'signup-domain.com';
                 Domain::create([
                         'namespace' => $this->domain,
                         'status' => Domain::STATUS_ACTIVE,
                         'type' => Domain::TYPE_PUBLIC,
                 ]);
             }
         }
 
         return $this->domain;
     }
 
     /**
      * Test fetching plans for signup
      */
     public function testSignupPlans(): void
     {
         $response = $this->get('/api/auth/signup/plans');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertCount(2, $json['plans']);
         $this->assertArrayHasKey('title', $json['plans'][0]);
         $this->assertArrayHasKey('name', $json['plans'][0]);
         $this->assertArrayHasKey('description', $json['plans'][0]);
         $this->assertArrayHasKey('button', $json['plans'][0]);
     }
 
     /**
      * Test fetching invitation
      */
     public function testSignupInvitations(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         // Test existing invitation
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($invitation->id, $json['id']);
 
         // Test non-existing invitation
         $response = $this->get("/api/auth/signup/invitations/abc");
         $response->assertStatus(404);
 
         // Test completed invitation
         SI::where('id', $invitation->id)->update(['status' => SI::STATUS_COMPLETED]);
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(404);
     }
 
     /**
      * Test signup initialization with invalid input
      */
     public function testSignupInitInvalidInput(): void
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with missing name
         $data = [
             'email' => 'UsersApiControllerTest1@UsersApiControllerTest.com',
             'first_name' => str_repeat('a', 250),
             'last_name' => str_repeat('a', 250),
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('first_name', $json['errors']);
         $this->assertArrayHasKey('last_name', $json['errors']);
 
         // Data with invalid email (but not phone number)
         $data = [
             'email' => '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Sanity check on voucher code, last/first name is optional
         $data = [
             'voucher' => '123456789012345678901234567890123',
             'email' => 'valid@email.com',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Email address too long
         $data = [
             'email' => str_repeat('a', 190) . '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
-        $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
+        $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         SignupCode::truncate();
 
         // Email address limit check
         $data = [
             'email' => 'test@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.email_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
-        $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
+        $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // IP address limit check
         $data = [
             'email' => 'ip@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
         \config(['app.signup.ip_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.ip_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
-        $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
+        $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // TODO: Test phone validation
     }
 
     /**
      * Test signup initialization with valid input
      */
     public function testSignupInitValidInput(): array
     {
         Queue::fake();
 
         // Assert that no jobs were pushed...
         Queue::assertNothingPushed();
 
         $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'individual',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
-        $this->assertCount(2, $json);
+
+        $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
+        $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Try the same with voucher
         $data['voucher'] = 'TEST';
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
-        $this->assertCount(2, $json);
+        $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
+        $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->voucher === $data['voucher']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         return [
             'code' => $json['code'],
             'email' => $data['email'],
             'first_name' => $data['first_name'],
             'last_name' => $data['last_name'],
             'plan' => $data['plan'],
             'voucher' => $data['voucher']
         ];
     }
 
     /**
      * Test signup code verification with invalid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $result['code'],
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test signup code verification with valid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyValidInput(array $result): array
     {
         $code = SignupCode::find($result['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame($result['email'], $json['email']);
         $this->assertSame($result['first_name'], $json['first_name']);
         $this->assertSame($result['last_name'], $json['last_name']);
         $this->assertSame($result['voucher'], $json['voucher']);
         $this->assertSame(false, $json['is_domain']);
         $this->assertTrue(is_array($json['domains']) && !empty($json['domains']));
 
         return $result;
     }
 
     /**
      * Test last signup step with invalid input
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(3, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Passwords do not match and missing domain
         $data = [
             'login' => 'test',
             'password' => 'test',
             'password_confirmation' => 'test2',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Login too short, password too short
         $data = [
             'login' => '1',
             'domain' => $domain,
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Missing codes
         $data = [
             'login' => 'login-valid',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         $code = SignupCode::find($result['code']);
 
         // Data with invalid voucher
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
             'voucher' => 'XXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Valid code, invalid login
         $data = [
             'login' => 'żżżżżż',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
     }
 
     /**
      * Test last signup step with valid input (user creation)
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupValidInput(array $result): void
     {
         $queue = Queue::fake();
 
         $domain = $this->getPublicDomain();
         $identity = \strtolower('SignupLogin@') . $domain;
         $code = SignupCode::find($result['code']);
         $data = [
             'login' => 'SignupLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
             'voucher' => 'TEST',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
         $this->assertSame($identity, $json['email']);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userEmail === \strtolower($data['login'] . '@' . $data['domain']);
             }
         );
 
         // Check if the code has been removed
         $this->assertNull(SignupCode::where('code', $result['code'])->first());
 
         // Check if the user has been created
         $user = User::where('email', $identity)->first();
 
         $this->assertNotEmpty($user);
         $this->assertSame($identity, $user->email);
 
         // Check user settings
         $this->assertSame($result['first_name'], $user->getSetting('first_name'));
         $this->assertSame($result['last_name'], $user->getSetting('last_name'));
         $this->assertSame($result['email'], $user->getSetting('external_email'));
 
         // Discount
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup for a group (custom domain) account
      */
     public function testSignupGroupAccount(): void
     {
         Queue::fake();
 
         // Initial signup request
         $user_data = $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'group',
         ];
 
         $response = $this->withoutMiddleware()->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
-        $this->assertCount(2, $json);
+        $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
+        $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Verify the code
         $code = SignupCode::find($json['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $result);
         $this->assertSame('success', $result['status']);
         $this->assertSame($user_data['email'], $result['email']);
         $this->assertSame($user_data['first_name'], $result['first_name']);
         $this->assertSame($user_data['last_name'], $result['last_name']);
         $this->assertSame(null, $result['voucher']);
         $this->assertSame(true, $result['is_domain']);
         $this->assertSame([], $result['domains']);
 
         // Final signup request
         $login = 'admin';
         $domain = 'external.com';
         $data = [
             'login' => $login,
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame("$login@$domain", $result['email']);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainNamespace === $domain;
             }
         );
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
 
                 return $userEmail === $data['login'] . '@' . $data['domain'];
             }
         );
 
         // Check if the code has been removed
         $this->assertNull(SignupCode::find($code->id));
 
         // Check if the user has been created
         $user = User::where('email', $login . '@' . $domain)->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($user_data['email'], $user->getSetting('external_email'));
         $this->assertSame($user_data['first_name'], $user->getSetting('first_name'));
         $this->assertSame($user_data['last_name'], $user->getSetting('last_name'));
 
         // TODO: Check domain record
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup via invitation
      */
     public function testSignupViaInvitation(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         $post = [
             'invitation' => 'abc',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'login' => 'test-inv',
             'domain' => 'kolabnow.com',
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         // Test invalid invitation identifier
         $response = $this->post('/api/auth/signup', $post);
         $response->assertStatus(404);
 
         // Test valid input
         $post['invitation'] = $invitation->id;
         $response = $this->post('/api/auth/signup', $post);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame('test-inv@kolabnow.com', $result['email']);
 
         // Check if the user has been created
         $user = User::where('email', 'test-inv@kolabnow.com')->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
         $this->assertSame($post['first_name'], $user->getSetting('first_name'));
         $this->assertSame($post['last_name'], $user->getSetting('last_name'));
 
         $invitation->refresh();
 
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertTrue($invitation->isCompleted());
 
         // TODO: Test POST params validation
     }
 
     /**
      * List of login/domain validation cases for testValidateLogin()
      *
      * @return array Arguments for testValidateLogin()
      */
     public function dataValidateLogin(): array
     {
         $domain = $this->getPublicDomain();
 
         return [
             // Individual account
             ['', $domain, false, ['login' => 'The login field is required.']],
             ['test123456', 'localhost', false, ['domain' => 'The specified domain is invalid.']],
             ['test123456', 'unknown-domain.org', false, ['domain' => 'The specified domain is invalid.']],
             ['test.test', $domain, false, null],
             ['test_test', $domain, false, null],
             ['test-test', $domain, false, null],
             ['admin', $domain, false, ['login' => 'The specified login is not available.']],
             ['administrator', $domain, false, ['login' => 'The specified login is not available.']],
             ['sales', $domain, false, ['login' => 'The specified login is not available.']],
             ['root', $domain, false, ['login' => 'The specified login is not available.']],
 
             // Domain account
             ['admin', 'kolabsys.com', true, null],
             ['testnonsystemdomain', 'invalid', true, ['domain' => 'The specified domain is invalid.']],
             ['testnonsystemdomain', '.com', true, ['domain' => 'The specified domain is invalid.']],
         ];
     }
 
     /**
      * Signup login/domain validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateLogin
      */
     public function testValidateLogin($login, $domain, $external, $expected_result): void
     {
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * Signup login/domain validation, more cases
      */
     public function testValidateLoginMore(): void
     {
         Queue::fake();
 
         // Test registering for an email of an existing group
         $login = 'group-test';
         $domain = 'kolabnow.com';
         $group = $this->getTestGroup("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted group
         $group->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing user
         $domain = $this->getPublicDomain();
         $login = 'signuplogin';
         $user = $this->getTestUser("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted user
         $user->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for a domain that exists
         $external = true;
         $domain = $this->getTestDomain(
             'external.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
 
         // Test registering for a domain that exists but is soft-deleted
         $domain->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
     }
 }
diff --git a/src/tests/Feature/PlanTest.php b/src/tests/Feature/PlanTest.php
index feac294b..aacb81a7 100644
--- a/src/tests/Feature/PlanTest.php
+++ b/src/tests/Feature/PlanTest.php
@@ -1,124 +1,127 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Entitlement;
 use App\Plan;
 use App\Sku;
 use Tests\TestCase;
 
 class PlanTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         Plan::where('title', 'test-plan')->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         Plan::where('title', 'test-plan')->delete();
 
         parent::tearDown();
     }
 
     /**
      * Tests for plan attributes localization
      */
     public function testPlanLocalization(): void
     {
         $plan = Plan::create([
             'title' => 'test-plan',
             'description' => [
                 'en' => 'Plan-EN',
                 'de' => 'Plan-DE',
             ],
             'name' => 'Test',
         ]);
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
 
         $plan->save();
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
         $this->assertSame('Plan-DE', $plan->getTranslation('description', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'de'));
 
         $plan->setTranslation('name', 'de', 'Prüfung')->save();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         // TODO: Test system locale change
     }
 
     /**
      * Tests for Plan::hasDomain()
      */
     public function testHasDomain(): void
     {
         $plan = Plan::where('title', 'individual')->first();
 
         $this->assertTrue($plan->hasDomain() === false);
 
         $plan = Plan::where('title', 'group')->first();
 
         $this->assertTrue($plan->hasDomain() === true);
     }
 
     /**
      * Test for a plan's cost.
      */
     public function testCost(): void
     {
         $plan = Plan::where('title', 'individual')->first();
 
         $package_costs = 0;
 
         foreach ($plan->packages as $package) {
             $package_costs += $package->cost();
         }
 
         $this->assertTrue(
             $package_costs == 990,
             "The total costs of all packages for this plan is not 9.90"
         );
 
         $this->assertTrue(
             $plan->cost() == 990,
             "The total costs for this plan is not 9.90"
         );
 
         $this->assertTrue($plan->cost() == $package_costs);
     }
 
+    /**
+     * Tests for Plan::tenant()
+     */
     public function testTenant(): void
     {
         $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
 
         $tenant = $plan->tenant()->first();
 
         $this->assertInstanceof(\App\Tenant::class, $tenant);
         $this->assertSame((int) \config('app.tenant_id'), $tenant->id);
 
         $tenant = $plan->tenant;
 
         $this->assertInstanceof(\App\Tenant::class, $tenant);
         $this->assertSame((int) \config('app.tenant_id'), $tenant->id);
     }
 }
diff --git a/src/tests/Unit/Rules/SignupTokenTest.php b/src/tests/Unit/Rules/SignupTokenTest.php
new file mode 100644
index 00000000..f48fb946
--- /dev/null
+++ b/src/tests/Unit/Rules/SignupTokenTest.php
@@ -0,0 +1,60 @@
+<?php
+
+namespace Tests\Unit\Rules;
+
+use App\Rules\SignupToken;
+use Illuminate\Support\Facades\Validator;
+use Tests\TestCase;
+
+class SignupTokenTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        @unlink(storage_path('signup-tokens.txt'));
+
+        $john = $this->getTestUser('john@kolab.org');
+        $john->settings()->where('key', 'signup_token')->delete();
+
+        parent::tearDown();
+    }
+
+    /**
+     * Tests the resource name validator
+     */
+    public function testValidation(): void
+    {
+        $tokens = ['1234567890', 'abcdefghijk'];
+        file_put_contents(storage_path('signup-tokens.txt'), implode("\n", $tokens));
+
+        $rules = ['token' => [new SignupToken()]];
+
+        // Empty input
+        $v = Validator::make(['token' => null], $rules);
+        $this->assertSame(['token' => ["The signup token is invalid."]], $v->errors()->toArray());
+
+        // Length limit
+        $v = Validator::make(['token' => str_repeat('a', 192)], $rules);
+        $this->assertSame(['token' => ["The signup token is invalid."]], $v->errors()->toArray());
+
+        // Non-existing token
+        $v = Validator::make(['token' => '123'], $rules);
+        $this->assertSame(['token' => ["The signup token is invalid."]], $v->errors()->toArray());
+
+        // Valid tokens
+        $v = Validator::make(['token' => $tokens[0]], $rules);
+        $this->assertSame([], $v->errors()->toArray());
+
+        $v = Validator::make(['token' => strtoupper($tokens[1])], $rules);
+        $this->assertSame([], $v->errors()->toArray());
+
+        // Tokens already used
+        $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('signup_token', $tokens[0]);
+
+        $v = Validator::make(['token' => $tokens[0]], $rules);
+        $this->assertSame(['token' => ["The signup token is invalid."]], $v->errors()->toArray());
+    }
+}