The first users decide what you learn. With open signup, that cohort is chosen by whoever happens to find you, and every outage is a public incident multiplied by every account. An invite code is a smaller commitment: you choose the people, you watch what breaks, and the story stays inside a room you control.
The mechanics matter more than the idea. Generate codes server-side, keep them human-readable so they can be dictated over a call, bound them by uses and expiry, and make disabling one-way so a leaked code dies without a migration. A code you cannot revoke is not a gate, it is a souvenir.
Redemption should be boring: it records who used which code and then gets out of the way. Coupling invites to your credit ledger looks convenient until you need to revoke an invitation or explain a balance; keep attribution and money in separate books, and let the audit trail be the proof of who came in on what.
Then operate the list like revenue. Create one code per cohort, write the note while the context is fresh, and check the usage numbers the same way you check invoices. When a code hits its limit or expires, that is a decision point you scheduled, not an accident you discovered.