Mac: launch at login through the official login-item API. Invites say who invited you before you accept; inviting someone without an account explains the next step. A device that joined with a software identity key now reads exactly what that means and how to change it.