The invite code is not intended to be used in a setpassword request. Instead you can perform the setpassword from a service user with enough permissions. In our typescript login implementation we currently only allow setting the password without code if no other authentication method is set on the user resource.