Users create organisations, invite colleagues and switch between them from inside your app. Each token speaks for one organisation and carries its role, so your API checks permissions offline, with a type for every one. Enterprise SSO and SCIM come per organisation.
Let a customer bring their team on day one: an organisation, invites and roles, with no members table of your own.
Each organisation gets its own SAML or OIDC sign-in, verified email domains and members provisioned by their directory.
Permissions are strings you define once. A misspelt one fails to compile, and one guard checks them in your API.
Users create organisations, change roles and leave, through the SDK. Admins manage every organisation in the dashboard.
Email invites are single use and tied to the address; links can be shared. Both expire, and both open a page of your app.
Owner, admin and member are built in. Add your own roles with the permissions they grant; members carry them in the token.
One call switches the active organisation for this session only. The next token speaks for the new organisation, and the others are listed for your switcher.
A SAML or OIDC connection per organisation, verified email domains, and members added and removed by their directory.
The organisation and its role are in the token. Your API verifies it with cached keys and one guard; the browser asks the same question with auth.can().
When a user signs in, their token carries who they are, their organisation and role, their plan and payment status, and what your flags target. Your API checks it in one guard, offline, and your UI reads the same answers.
sub · amrorg.rolebilling.planflag()The browser client creates the organisation and invites a colleague with the user's own token. After the switch, the next token carries the organisation and the role, and your API's guard reads them offline.
// In the browser: the user creates an organisation, invites a colleague and switches to it
const org = await auth.orgs.create({ name: 'Acme' }); // the user is its owner
await auth.orgs.invite(org.id, { email: 'bob@acme.example', role: 'admin' }); // mailed; or a link
await auth.switchOrg(org.id); // the next tokens speak for Acme: user.org, user.orgRole
if (auth.can('members:manage')) showMembersPage(); // the same roles as the API's
// access.ts: roles once, shared by your API and the browser; a misspelt permission fails to compile
export const access = defineAccess({
roles: { member: ['report:read'], admin: ['report:*', 'members:manage'], owner: ['*'] },
});
// api/server.ts: the org and its role are in the token; one guard checks them offline
app.post('/api/members', api.require('members:manage'), addMember);
app.get('/api/orgs/:org/settings', api.guard({ org: (c) => c.req.param('org'), orgRole: ['owner', 'admin'] }), settings);Prices in euros, excluding VAT. Test environments include every feature on every plan.
Included
Included
Included
Included
Included
Included
Yes, when you turn it on in the project's settings. Otherwise admins create them in the dashboard. Either way, the user who creates an organisation is its owner.
A custom role names the permissions it grants, the same strings as your defineAccess roles. A member holding it carries them in the token, so your guards grant them without a new entry.
Yes. Each token speaks for one, the active organisation, and lists the others so you can show a switcher. Switching changes this session only; the user's other sessions keep theirs.
Yes. Each organisation can have its own SAML or OIDC connection and verified domains, and SCIM keeps its members in step with the directory. Members a directory provisions stay the directory's.
Turn on self-service organisations in the test environment, create one from your app and watch the role arrive in the token.
Hosted sign-in, organisations, roles and enterprise SSO.
Plans, checkout, invoices and EU VAT, with the plan in the token.
Targeting and rollouts, evaluated offline from the token.
Talk to your users beside their plan, roles and flags.
Act as a user with a reason, a time limit and an audit trail.
Chat with visitors, and keep them when they sign up.