Staff roles

Besides admin (everything) and user (nothing), define your own staff roles with any of Better Auth's Admin permissions:

export default defineNuxtConfig({
  betterAuthUi: {
    admin: {
      roles: {
        // Handles reports: views, edits and bans users, and signs their sessions out.
        moderator: { user: ['list', 'get', 'update', 'ban'], session: ['list', 'revoke'] },
        // Can look, not touch.
        support: { user: ['list', 'get'], session: ['list'] }
      }
    }
  }
})

Give someone a role from Change role on their page, which lists the roles you've configured.

Permissions

A permission that isn't on this list fails the build, with the list of valid ones.

What a role gets

• Into the admin: roles that can list users open the admin pages, and count as staff, with their own filter on the users list.
• Only their actions: the pages show only what a role allows. A moderator has no Delete, Change role or Add user; the email field is locked without set-email; and Password offers only the reset link without set-password.
• Several roles: a user with several roles (Better Auth stores them comma-separated) gets everything any of them allows.

Enforced by Better Auth

The module builds the roles with Better Auth's own access control and passes them to the Admin plugin, so every Better Auth endpoint checks the same permissions, and so do the module's own routes. The pages read the same roles, so they show exactly what the server would allow.

Requiring two-factor

Staff roles are a good fit for twoFactor.required:

export default defineNuxtConfig({
  betterAuthUi: {
    twoFactor: { enabled: true, required: ['admin', 'moderator'] }
  }
})