There is no self-signup for families
A family cannot create their own account, and nothing on your website offers them one. The only way in is an invitation you send. That is the intended shape: your customer list is yours, and somebody typing an email address should not be able to add themselves to it.
Where the control actually is
Open the family's booking and look at its Overview — the Family portal access card is there. It is not on the customer's own record page, which is the first place most people look, so if you have been hunting for it on the customer screen that is why you have not found it.
The card shows which of four states the family is in: not invited, invited, active, or disabled. Sending, resending and revoking are all done from there.
What the invite is
A single-use link, good for seventy-two hours, emailed to the address already on that customer's record. If there is no email address on the record the invite is refused rather than guessed at, and if email sending is not configured for your workspace nothing is written at all, so you never end up with a token nobody can spend.
Re-inviting somebody mints a fresh link and kills the previous one the moment it is sent. That is the fix when a family says the link has expired.
Revoking, and the password they cannot reset
Revoking a login disables it, clears any outstanding invitation, and signs out any session that is currently open — not just the next one.
Families have no self-service password reset. The reset flow on the sign-in page is for people on your team, so a family who is locked out has to come back to you for a fresh link. Worth saying out loud when you invite them.