Configure

Organizations are configured in the Better Auth setup in lib/auth/index.ts. The organization plugin is already enabled by default.

Organization Plugin Configuration

The organization plugin is configured in lib/auth/index.ts:

import { organization } from 'better-auth/plugins';

export const auth = betterAuth({
  // ... other config
  plugins: [
    organization({
      // Organization configuration
    })
  ]
});

Default Behavior

By default, organizations are:

• Enabled - Users can create and join organizations
• Optional - Users don't need to be in an organization to use the app
• Visible - Organization selection is shown in the UI
• User-creatable - Users can create new organizations

Customizing Organization Behavior

Require Organization

To require users to be in an organization to access the application, you can add middleware or route protection:

import { redirect } from 'next/navigation';

import { getSession } from '@/lib/auth/server';

export async function middleware(request: NextRequest) {
  const session = await getSession();

  if (!session) {
    return redirect('/auth/sign-in');
  }

  // Check if user has an active organization
  if (!session.session.activeOrganizationId) {
    // Redirect to organization creation/selection
    return redirect('/dashboard/onboarding');
  }
}

Hide Organization Selection

If you want to build a single-tenant application where users should only be members of one organization, you can hide the organization switcher in your UI components.

Disable Organization Creation

To block regular users from creating organizations through the starter's tRPC procedure, change the shipped app configuration:

export const appConfig = {
  // ... other config
  organizations: {
    allowUserCreation: false
  }
};

The trpc.organization.create procedure enforces this setting for non-admin users. Platform admins can still create organizations through that procedure. The setting does not configure Better Auth's organization endpoint. Passing allowUserToCreateOrganization: false to that plugin blocks everyone through the direct endpoint. Use a function for an endpoint policy that still permits selected users such as platform admins.

Shipped Organization Hooks

The Better Auth organization plugin is configured in lib/auth/index.ts. The shipped integration provides a custom invitation email callback and hooks that synchronize subscription seats after membership changes:

organization({
  sendInvitationEmail: async ({ email, inviter, id, organization }) => {
    // Check plan limits, build the invitation URL and send the email.
  },
  organizationHooks: {
    afterAddMember: async ({ organization }) => {
      await syncOrganizationSeats(organization.id);
    },
    afterRemoveMember: async ({ organization }) => {
      await syncOrganizationSeats(organization.id);
    },
    afterAcceptInvitation: async ({ organization }) => {
      await syncOrganizationSeats(organization.id);
    }
  }
});

The repositories do not pass memberRoles, invitation.expiresIn or a top-level hooks object to this plugin. Add only options supported by the installed Better Auth version.

Invite-Only Organizations

There is no single invite-only organization switch. The starter includes member invitations and the allowUserCreation setting, but you must compose and enforce the policy your product needs.

For an invite-only organization setup:

1. Disable organization creation - Remove or restrict the create organization functionality
2. Require invitations - Only allow users to join via invitations
3. Control invitations - Only allow admins/owners to send invitations

The Better Auth organization plugin supplies the invitation workflow. Your application must still enforce who may create organizations and send invitations on every server-side path.

Best Practices

1. Use organization slugs - Use URL-friendly slugs for organization identification
2. Validate membership - Always verify user membership before allowing access
3. Scope data - Always scope data queries by organization ID
4. Handle edge cases - Handle cases where users have no organizations
5. Role-based access - Use roles to control what users can do