ADR-0002: Better Auth
Status: Accepted Date: 2026-08-05
Context
Section titled “Context”Hand-rolling auth is error prone; identity is not our differentiator.
Decision
Section titled “Decision”Adopt better-auth with organization, admin, and apiKey plugins behind a packages/auth wrapper; domain tables FK to better-auth’s tables; never edit generated tables.
Consequences
Section titled “Consequences”- Org-wide RBAC via access-control statements
- Project-scoped permissions remain our problem later
- Management API Keys use the plugin, but authenticating with them on
/rpcis deferred to Phase 2; see ADR-0004 - SDK key get their own table (edge-cacheable validation)
Alternatives Considered
Section titled “Alternatives Considered”- Clerk/Auth0 (vendor cost / less-control): rejected / deferred to later
- Hand-rolled: rejected