Thanks! Here’s a guide for migrating from Coherence to Pow: Migrating from Coherence — Pow v1.0.1
Also, in case anybody is interested, there was a discussion on how Pow could be used with GraphQL endpoints that highlights how useful the modular setup is for when you need a custom flow: Use Pow.PasswordReset.Plug.create_reset_token without a conn · Issue #61 · pow-auth/pow · GitHub
There’s been a few questions on Github on how to use Pow on read-only platforms like Heroku. For production run the ETS cache is not recommended, and the Mnesia cache requires write access.
So I’ve written a guide on how to use Redis instead: https://github.com/danschultzer/pow/blob/master/guides/REDIS_CACHE_STORE_BACKEND.md
You are not limited to Redis as an alternative. It’s super easy to switch to whichever key-value store you prefer or have access to 
I’ve been working on an invitation extension that provides a basic platform for this: PowInvitation extension by danschultzer · Pull Request #113 · pow-auth/pow · GitHub
You can check out the readme for to see how the extension can be used: https://github.com/danschultzer/pow/blob/pow-invitation/lib/extensions/invitation/README.md
It should cover most or all your requirements
You can try it out by pulling the pow-invitation branch from github. It’s still WIP but it works. As always, feedback is most welcome and will help a lot!
Changelog: Github
Hex: https://hex.pm/packages/pow/1.0.3
Now it is super easy to add an invitation system to your platform with Pow! Check out the documentation to see how easy it is to configure it for your exact needs: https://github.com/danschultzer/pow/blob/v1.0.3/lib/extensions/invitation/README.md
This has been a highly requested feature, and I’m happy that we finally got a flexible solution in Pow.
WebAuthn standard has been finalized! I believe Pow should have built-in 2FA/password-less authentication support, and this is something I hope to look at soon. I would be grateful for any input.
There’s an issue for it here: WebAuthn and multi factor support · Issue #6 · pow-auth/pow · GitHub
So far this has been a self-funded project, and I’ve been fortunate enough to have enough time to work full time on this. However I’ll probably get back to my startup life soon, so I’ve worked hard to streamline the codebase, and made it easy for others to join in.
The best way to help out is to open PR’s or helping with issues. When you become familiar with how Pow works you will be invited to join as maintainer. Thanks!
Pow definitely needs some eyes on security practices. @griffinbyatt is one of the few people I’ve seen doing this. If there’s any person or company that’s willing to put some time into this, I would be deeply grateful.
Happy coding 
You might want to contact Radically Open Security. Testing the security of an open source auth system seems like it would be right up their alley.
@danschultzer Can you give us a quick iex snippet on how to programmatically change a user’s password?
Additionally, some of us could really use a separate umbrella step-by-step tutorial. Right now I am not even sure if some parts of the config belong to the Ecto app or the Phoenix app. 
As an example: when I execute mix pow.phoenix.gen.templates it keeps telling me to add the web_module: ... snippet to my config even though both my apps have that in their config. So it quickly gets confusing for umbrella users.
There’re multiple ways, and it depends on the usage. If you don’t care about validating anything but the password, then just run:
Thank you for the hard work!User.pow_password_changeset(user, %{"password" => password, "confirm_password" => password})
I think this confusion can be eliminated by just having better mix helper messages, e.g. ignore :web_module instructions if the :web_module has already been set in config. This would probably go most of the way. You would only need to put the config in the Phoenix app.