Better Auth in Rust

Organization

Multi-tenancy with organizations, members, invitations, and RBAC.

The OrganizationPlugin provides multi-tenancy support with organizations, membership management, invitation workflows, and role-based access control (RBAC).

Setup

use better_auth::plugins::OrganizationPlugin;

let auth = BetterAuth::new(config)
    .database(database)
    .plugin(OrganizationPlugin::new())
    .build()
    .await?;

Configuration

use better_auth::plugins::organization::OrganizationConfig;

let auth = BetterAuth::new(config)
    .database(database)
    .plugin(
        OrganizationPlugin::new()
            .allow_user_to_create_organization(true)
            .organization_limit(5)
            .membership_limit(50)
            .creator_role("owner")
            .invitation_expires_in(172800) // 48 hours
            .invitation_limit(100)
    )
    .build()
    .await?;
OptionTypeDefaultDescription
allow_user_to_create_organizationbooltrueAllow users to create organizations
organization_limitOption<usize>NoneMax organizations per user
membership_limitOption<usize>Some(100)Max members per organization
creator_roleString"owner"Role assigned to organization creator
invitation_expires_inu64172800 (48h)Invitation expiration in seconds
invitation_limitOption<usize>Some(100)Max pending invitations per org
disable_organization_deletionboolfalsePrevent organization deletion

RBAC (Role-Based Access Control)

Default Roles

RoleOrganizationMemberInvitation
ownerupdate, deletecreate, update, deletecreate, cancel
adminupdatecreate, update, deletecreate, cancel
member

Custom Roles

Extend the default roles with custom permissions:

use better_auth::plugins::organization::config::{OrganizationConfig, RolePermissions};
use std::collections::HashMap;

let mut roles = HashMap::new();
roles.insert("editor".to_string(), RolePermissions {
    organization: vec!["read".to_string()],
    member: vec!["read".to_string()],
    invitation: vec![],
});

let config = OrganizationConfig {
    roles,
    ..Default::default()
};

let auth = BetterAuth::new(auth_config)
    .database(database)
    .plugin(OrganizationPlugin::with_config(config))
    .build()
    .await?;

Resources and Actions

Resources: organization, member, invitation

Actions: create, read, update, delete, cancel

API Endpoints

The Organization plugin exposes 18 endpoints. For full request/response details, see the OpenAPI Reference.

Organization CRUD

EndpointMethodDescription
/organization/createPOSTCreate a new organization
/organization/updatePOSTUpdate organization details
/organization/deletePOSTDelete an organization
/organization/listGETList user's organizations
/organization/get-full-organizationGETGet organization with members and invitations
/organization/check-slugPOSTCheck slug availability
/organization/set-activePOSTSet active organization on session
/organization/leavePOSTLeave an organization

Member Management

EndpointMethodDescription
/organization/get-active-memberGETGet current member record
/organization/list-membersGETList organization members (with pagination)
/organization/remove-memberPOSTRemove a member (requires member:delete)
/organization/update-member-rolePOSTUpdate member role (requires member:update)

Invitations

EndpointMethodDescription
/organization/invite-memberPOSTInvite a user by email
/organization/get-invitationGETGet invitation details
/organization/list-invitationsGETList organization invitations
/organization/list-user-invitationsGETList invitations for current user
/organization/accept-invitationPOSTAccept an invitation
/organization/reject-invitationPOSTReject an invitation
/organization/cancel-invitationPOSTCancel an invitation (requires invitation:cancel)

Permission Check

EndpointMethodDescription
/organization/has-permissionPOSTCheck if user has specific permissions

Errors

StatusCondition
400Invalid slug format or missing required fields
403Insufficient permissions for the operation
404Organization, member, or invitation not found
409Slug already taken or user already a member

On this page