The Client-Server Matrix protocol allows to limit registrations based on tokens, Synapse (and other Matrix servers) support this feature and have an admin API to manage these tokens.

matrixtoken is a tool that allows users of the system to generate Matrix registration tokens from the homeserver admin API, without being admins themselves.

It is supposed to be used with the SUID mode to allow it to read its config file containing the admin's access token. See the example configuration file for all the available options.

After it has been installed and configured, users can simply run:

matrixtoken

Which will return a token with a limited amount of uses and an expiration date (by default 1 use and 30 days of validity).