Better Auth sessions with application-owned user projections.
Identity flows
Better Auth terminates password, verified-email, magic-link, recovery, and optional social-provider flows. Application code reads a normalized principal and keeps product data in projection tables.
Authorization
Platform roles control administration. Workspace roles are resolved from the session and route slug before every tenant mutation.
| Role | Typical capabilities |
|---|---|
| Owner | Billing, members, settings, deletion, and project approval |
| Admin | Billing, members, settings, and project approval |
| Member | Project and comment collaboration |
| Readonly | Tenant reads only |
Impersonation
Restricted admin impersonation is read-only. Mutations, API-key actions, account deletion, workspace creation, and invitation settlement fail closed until the administrator stops impersonating.
Abuse controls
Authentication mutations pass through a Durable Object limiter keyed by Cloudflare IP and, where appropriate, a hash of the normalized identity. Missing limiter infrastructure fails closed outside localhost.