organization-best-practices

Configure multi-tenant organizations, roles, teams, and invitations using Better Auth's organization plugin.

Updated Jul 24, 2026
One-click install
npx skills add https://github.com/saad-tayyab/lumora --skill organization-best-practices-saad-tayyab
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: organization-best-practices
Source: https://github.com/saad-tayyab/lumora/tree/main/.agents/skills/organization-best-practices
Command: npx skills add https://github.com/saad-tayyab/lumora --skill organization-best-practices-saad-tayyab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth, @better-auth/organization.

What problem does it solve? Setting up multi-tenant organization management—members, invitations, roles, teams, and RBAC—requires wiring together many Better Auth organization plugin APIs correctly, and mistakes in ownership handling or permission checks create security gaps. ## Core Features & Use Cases - Organization & Member Management: Create organizations, set active organizations, add or remove members, and assign single or multiple roles with configurable limits. - Invitations & Teams: Send invitation emails, generate shareable invitation URLs, and organize members into teams with configurable limits. - RBAC & Dynamic Access Control: Check permissions, create custom roles with dynamic access control, and enforce owner-protection rules. - Use Case: A SaaS application needs workspace-style tenancy where users create organizations, invite teammates by email, assign admin or custom moderator roles, and group members into engineering teams. ## Quick Start Set up the Better Auth organization plugin with teams and invitations enabled, then create an organization and invite a member by email.

Frequently Asked Questions about organization-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up organizations with Better Auth?

Add the organization() plugin to your Better Auth server config and organizationClient() to the client config, then run the Better Auth CLI migrate command to create the organization, member, and invitation tables in your database.

How do I invite members to an organization in Better Auth?

Use authClient.organization.inviteMember with the invitee's email and role. Configure sendInvitationEmail in the plugin options to deliver the invitation, or use getInvitationURL to generate a shareable link you deliver yourself.

Does Better Auth support custom roles and permissions?

Yes, enable dynamicAccessControl in the organization plugin options, then create custom roles with createRole by specifying permissions per resource. Use the hasPermission endpoint for dynamic checks and checkRolePermission for static client-side rendering.

Why can't I remove the owner from an organization?

Better Auth protects the last owner: the last owner cannot be removed, leave, or lose the owner role. Transfer ownership first by assigning the owner role to another member with updateMemberRole, then remove the previous owner.

How do I add teams to organizations in Better Auth?

Enable teams in the organization plugin options with teams.enabled set to true, then use createTeam, addTeamMember, and removeTeamMember. You can configure maximumTeams and maximumMembersPerTeam limits.