Agent skill · operations · better-auth
organization-best-practices
Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.
Why this skill is useful
Provides specific implementation patterns and configurations for managing multi-tenant organizations using Better Auth's organization plugin that the AI wouldn't reliably generate on its own.
What it needs
Requires @better-auth/cli installed locally. About 5k tokens when loaded. Last updated 2026-07-11. 206 stars on the source repository.
What this skill does
Setup 1. Add organization() plugin to server config 2. Add organizationClient() plugin to client config 3. Run npx auth@latest migrate (built-in adapter) or generate + push for Drizzle/Prisma 4. Verify: check that organization, member, invitation tables exist in your database Client-Side Setup Creating Organizations The creator is automatically assigned the owner role. Controlling Organization Creation Restrict who can create organizations based on user attributes: Creating Organizations on Behalf of Users Administrators can create organizations for other users (server-side only): Note: The userId parameter cannot be used alongside session headers. Active Organizations Stored in the session and scopes subsequent API calls. Set after user selects one. Many endpoints use the active organization when organizationId is not provided (listMembers, listInvitations, inviteMember, etc.). Use getFullOrganization() to retrieve the active org with all members, invitations, and teams. Members Adding Members (Server-Side) For client-side member additions, use the invitation system instead. Assigning Multiple Roles Removing Members Use removeMember({ memberIdOrEmail }). The last owner cannot be removed — assign ownership to another member first. Updating Member Roles Use updateMemberRole({ memberId, role }). Membership Limits Invitations Setting Up Invitation Emails Sending Invitations Shareable Invitation URLs This endpoint does not call sendInvitationEmail — handle delivery yourself. Invitation Configuration Roles & Permissions Default roles: owner (full access), admin (manage members/invitations/settings), member (basic access). Checking Permissions Use checkRolePermission({ role, permissions }) for client-side UI rendering (static only). For dynamic access control, use the hasPermission endpoint. Teams Enabling Teams Creating Teams Managing Team Members Use addTeamMember({ teamId, userId }) (member must be in org first) and removeTeamMember({ teamId, userId }) (stays in org). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills better-auth/organization