[{"data":1,"prerenderedAt":1093},["ShallowReactive",2],{"navigation":3,"\u002Forganizations\u002Fsso":178,"\u002Forganizations\u002Fsso-surround":1088},[4,23,78,95,123,143,158],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Configuration","\u002Fgetting-started\u002Fconfiguration","1.getting-started\u002F3.configuration","i-lucide-settings",false,{"title":24,"icon":22,"path":25,"stem":26,"children":27,"page":22},"Sign-in","\u002Fsign-in","2.sign-in",[28,33,38,43,48,53,58,63,68,73],{"title":29,"path":30,"stem":31,"icon":32},"Sign-in pages","\u002Fsign-in\u002Fpages","2.sign-in\u002F1.pages","i-lucide-log-in",{"title":34,"path":35,"stem":36,"icon":37},"Several accounts","\u002Fsign-in\u002Fmulti-session","2.sign-in\u002F10.multi-session","i-lucide-users-round",{"title":39,"path":40,"stem":41,"icon":42},"Account page","\u002Fsign-in\u002Faccount","2.sign-in\u002F2.account","i-lucide-circle-user",{"title":44,"path":45,"stem":46,"icon":47},"Other methods","\u002Fsign-in\u002Fmethods","2.sign-in\u002F3.methods","i-lucide-key-square",{"title":49,"path":50,"stem":51,"icon":52},"Sign-in providers","\u002Fsign-in\u002Fproviders","2.sign-in\u002F4.providers","i-lucide-share-2",{"title":54,"path":55,"stem":56,"icon":57},"Two-factor","\u002Fsign-in\u002Ftwo-factor","2.sign-in\u002F5.two-factor","i-lucide-shield-check",{"title":59,"path":60,"stem":61,"icon":62},"Passkeys","\u002Fsign-in\u002Fpasskeys","2.sign-in\u002F6.passkeys","i-lucide-fingerprint",{"title":64,"path":65,"stem":66,"icon":67},"Phone numbers","\u002Fsign-in\u002Fphone-numbers","2.sign-in\u002F7.phone-numbers","i-lucide-smartphone",{"title":69,"path":70,"stem":71,"icon":72},"Signing in devices","\u002Fsign-in\u002Fdevices","2.sign-in\u002F8.devices","i-lucide-tv",{"title":74,"path":75,"stem":76,"icon":77},"Security","\u002Fsign-in\u002Fsecurity","2.sign-in\u002F9.security","i-lucide-lock-keyhole",{"title":79,"path":80,"stem":81,"children":82,"icon":22},"Organizations","\u002Forganizations","3.organizations\u002F1.index",[83,85,90],{"title":79,"path":80,"stem":81,"icon":84},"i-lucide-building-2",{"title":86,"path":87,"stem":88,"icon":89},"Roles","\u002Forganizations\u002Froles","3.organizations\u002F2.roles","i-lucide-shield",{"title":91,"path":92,"stem":93,"icon":94},"Single sign-on","\u002Forganizations\u002Fsso","3.organizations\u002F3.sso","i-lucide-key-round",{"title":96,"path":97,"stem":98,"children":99,"icon":22},"Admin dashboard","\u002Fadmin","4.admin\u002F1.index",[100,103,108,113,118],{"title":101,"path":97,"stem":98,"icon":102},"Overview","i-lucide-layout-dashboard",{"title":104,"path":105,"stem":106,"icon":107},"Managing users","\u002Fadmin\u002Fusers","4.admin\u002F2.users","i-lucide-user-cog",{"title":109,"path":110,"stem":111,"icon":112},"Staff roles","\u002Fadmin\u002Froles","4.admin\u002F3.roles","i-lucide-shield-user",{"title":114,"path":115,"stem":116,"icon":117},"Audit log","\u002Fadmin\u002Faudit-log","4.admin\u002F4.audit-log","i-lucide-history",{"title":119,"path":120,"stem":121,"icon":122},"Your own pages","\u002Fadmin\u002Fextending","4.admin\u002F5.extending","i-lucide-layout-panel-left",{"title":124,"icon":22,"path":125,"stem":126,"children":127,"page":22},"Integrations","\u002Fintegrations","5.integrations",[128,133,138],{"title":129,"path":130,"stem":131,"icon":132},"Stripe","\u002Fintegrations\u002Fstripe","5.integrations\u002F1.stripe","i-simple-icons-stripe",{"title":134,"path":135,"stem":136,"icon":137},"API keys","\u002Fintegrations\u002Fapi-keys","5.integrations\u002F2.api-keys","i-lucide-key",{"title":139,"path":140,"stem":141,"icon":142},"Tokens","\u002Fintegrations\u002Ftokens","5.integrations\u002F3.tokens","i-lucide-ticket",{"title":144,"icon":22,"path":145,"stem":146,"children":147,"page":22},"Customization","\u002Fcustomization","6.customization",[148,153],{"title":149,"path":150,"stem":151,"icon":152},"Emails","\u002Fcustomization\u002Femails","6.customization\u002F1.emails","i-lucide-mail",{"title":154,"path":155,"stem":156,"icon":157},"Languages","\u002Fcustomization\u002Flanguages","6.customization\u002F2.languages","i-lucide-languages",{"title":159,"icon":22,"path":160,"stem":161,"children":162,"page":22},"Reference","\u002Freference","7.reference",[163,168,173],{"title":164,"path":165,"stem":166,"icon":167},"How it works","\u002Freference\u002Fhow-it-works","7.reference\u002F1.how-it-works","i-lucide-cog",{"title":169,"path":170,"stem":171,"icon":172},"API reference","\u002Freference\u002Fapi","7.reference\u002F2.api","i-lucide-braces",{"title":174,"path":175,"stem":176,"icon":177},"Contributing","\u002Freference\u002Fcontributing","7.reference\u002F3.contributing","i-lucide-git-pull-request",{"id":179,"title":91,"body":180,"description":1081,"extension":1082,"links":1083,"meta":1084,"navigation":1085,"path":92,"seo":1086,"stem":93,"__hash__":1087},"docs\u002F3.organizations\u002F3.sso.md",{"type":181,"value":182,"toc":1068},"minimark",[183,188,200,205,447,457,461,464,481,484,504,508,515,519,525,595,601,605,608,630,634,640,662,666,669,672,686,885,905,909,920,924,1049,1064],[184,185],"screenshot",{"alt":186,"name":187},"An organization's SSO tab: an OIDC provider with its redirect URI, and the DNS record that verifies its domain","organization-sso",[189,190,191,192,199],"p",{},"Better Auth's ",[193,194,198],"a",{"href":195,"rel":196},"https:\u002F\u002Fbetter-auth.com\u002Fdocs\u002Fplugins\u002Fsso",[197],"nofollow","SSO plugin",". Each organization registers its own identity\nprovider (Okta, Microsoft Entra ID, Google Workspace, …), and its members sign in through it with their work email.",[201,202,204],"h2",{"id":203},"turning-it-on","Turning it on",[206,207,209,214,241,245,372,376,379,436,440],"steps",{"level":208},"3",[210,211,213],"h3",{"id":212},"install-the-plugins-package","Install the plugin's package",[215,216,222],"pre",{"className":217,"code":218,"filename":219,"language":220,"meta":221,"style":221},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pnpm add @better-auth\u002Fsso\n","Terminal","bash","",[223,224,225],"code",{"__ignoreMap":221},[226,227,230,234,238],"span",{"class":228,"line":229},"line",1,[226,231,233],{"class":232},"sBMFI","pnpm",[226,235,237],{"class":236},"sfazB"," add",[226,239,240],{"class":236}," @better-auth\u002Fsso\n",[210,242,244],{"id":243},"enable-it","Enable it",[215,246,251],{"className":247,"code":248,"filename":249,"language":250,"meta":221,"style":221},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  betterAuthUi: {\n    organization: { enabled: true },\n    sso: {\n      enabled: true,\n      \u002F\u002F New providers work once a DNS record proves the organization owns their domains.\n      domainVerification: true\n    }\n  }\n})\n","nuxt.config.ts","ts",[223,252,253,274,287,310,320,333,340,351,357,363],{"__ignoreMap":221},[226,254,255,259,262,266,270],{"class":228,"line":229},[226,256,258],{"class":257},"s7zQu","export",[226,260,261],{"class":257}," default",[226,263,265],{"class":264},"s2Zo4"," defineNuxtConfig",[226,267,269],{"class":268},"sTEyZ","(",[226,271,273],{"class":272},"sMK4o","{\n",[226,275,277,281,284],{"class":228,"line":276},2,[226,278,280],{"class":279},"swJcz","  betterAuthUi",[226,282,283],{"class":272},":",[226,285,286],{"class":272}," {\n",[226,288,290,293,295,298,301,303,307],{"class":228,"line":289},3,[226,291,292],{"class":279},"    organization",[226,294,283],{"class":272},[226,296,297],{"class":272}," {",[226,299,300],{"class":279}," enabled",[226,302,283],{"class":272},[226,304,306],{"class":305},"sfNiH"," true",[226,308,309],{"class":272}," },\n",[226,311,313,316,318],{"class":228,"line":312},4,[226,314,315],{"class":279},"    sso",[226,317,283],{"class":272},[226,319,286],{"class":272},[226,321,323,326,328,330],{"class":228,"line":322},5,[226,324,325],{"class":279},"      enabled",[226,327,283],{"class":272},[226,329,306],{"class":305},[226,331,332],{"class":272},",\n",[226,334,336],{"class":228,"line":335},6,[226,337,339],{"class":338},"sHwdD","      \u002F\u002F New providers work once a DNS record proves the organization owns their domains.\n",[226,341,343,346,348],{"class":228,"line":342},7,[226,344,345],{"class":279},"      domainVerification",[226,347,283],{"class":272},[226,349,350],{"class":305}," true\n",[226,352,354],{"class":228,"line":353},8,[226,355,356],{"class":272},"    }\n",[226,358,360],{"class":228,"line":359},9,[226,361,362],{"class":272},"  }\n",[226,364,366,369],{"class":228,"line":365},10,[226,367,368],{"class":272},"}",[226,370,371],{"class":268},")\n",[210,373,375],{"id":374},"trust-your-identity-providers-origins","Trust your identity providers' origins",[189,377,378],{},"Better Auth reads an OIDC provider's settings from its issuer, and only from origins you trust:",[215,380,383],{"className":247,"code":381,"filename":382,"language":250,"meta":221,"style":221},"export default defineServerAuth({\n  trustedOrigins: ['https:\u002F\u002Fyour-org.okta.com', 'https:\u002F\u002Flogin.microsoftonline.com']\n})\n","server\u002Fauth.config.ts",[223,384,385,398,430],{"__ignoreMap":221},[226,386,387,389,391,394,396],{"class":228,"line":229},[226,388,258],{"class":257},[226,390,261],{"class":257},[226,392,393],{"class":264}," defineServerAuth",[226,395,269],{"class":268},[226,397,273],{"class":272},[226,399,400,403,405,408,411,414,416,419,422,425,427],{"class":228,"line":276},[226,401,402],{"class":279},"  trustedOrigins",[226,404,283],{"class":272},[226,406,407],{"class":268}," [",[226,409,410],{"class":272},"'",[226,412,413],{"class":236},"https:\u002F\u002Fyour-org.okta.com",[226,415,410],{"class":272},[226,417,418],{"class":272},",",[226,420,421],{"class":272}," '",[226,423,424],{"class":236},"https:\u002F\u002Flogin.microsoftonline.com",[226,426,410],{"class":272},[226,428,429],{"class":268},"]\n",[226,431,432,434],{"class":228,"line":289},[226,433,368],{"class":272},[226,435,371],{"class":268},[210,437,439],{"id":438},"run-better-auths-migrations","Run Better Auth's migrations",[189,441,442,443,446],{},"The plugin adds an ",[223,444,445],{},"ssoProvider"," table.",[448,449,450],"tip",{},[189,451,452,453,456],{},"Turn on ",[223,454,455],{},"domainVerification"," in production. Without it, anyone who registers a provider for a domain can sign in\npeople with that domain's emails.",[201,458,460],{"id":459},"signing-in","Signing in",[189,462,463],{},"The sign-in page gets a \"Sign in with SSO\" button. People type either:",[465,466,467,475],"ul",{},[468,469,470,474],"li",{},[471,472,473],"strong",{},"their work email",": the provider is found by the email's domain;",[468,476,477,480],{},[471,478,479],{},"their organization's slug",": the organization's provider is used.",[189,482,483],{},"They're sent to their identity provider, and come back signed in. New users land on the account page, and a\nprovider that fails comes back with a message.",[189,485,486,487,490,491,494,495,498,499,503],{},"People who sign in through an organization's provider ",[471,488,489],{},"join that organization",", with ",[223,492,493],{},"defaultRole"," or the role\n",[223,496,497],{},"getRole"," gives them (see ",[193,500,502],{"href":501},"#who-joins-as-what","Who joins as what",").",[201,505,507],{"id":506},"setting-up-a-provider","Setting up a provider",[189,509,510,511,514],{},"Each organization's page gets an ",[471,512,513],{},"SSO"," tab, for its owners and admins (Better Auth allows only those roles).",[210,516,518],{"id":517},"adding-one","Adding one",[189,520,521,524],{},[471,522,523],{},"Add provider"," asks for:",[526,527,528,544],"table",{},[529,530,531],"thead",{},[532,533,534,538,541],"tr",{},[535,536,537],"th",{},"Field",[535,539,540],{},"OIDC",[535,542,543],{},"SAML",[545,546,547,563,573,584],"tbody",{},[532,548,549,553,560],{},[550,551,552],"td",{},"Provider ID",[550,554,555,556,559],{},"A name for it, part of its addresses (",[223,557,558],{},"acme-okta",")",[550,561,562],{},"Same",[532,564,565,568,571],{},[550,566,567],{},"Email domains",[550,569,570],{},"Whose users sign in with it, comma-separated",[550,572,562],{},[532,574,575,578,581],{},[550,576,577],{},"Issuer",[550,579,580],{},"The provider's issuer URL; the rest is read from it",[550,582,583],{},"Your app's entity ID for the provider",[532,585,586,589,592],{},[550,587,588],{},"Credentials",[550,590,591],{},"Client ID and client secret",[550,593,594],{},"Sign-on URL, then the metadata XML, or its entity ID and certificate",[189,596,597,600],{},[471,598,599],{},"More settings"," has the rest: scopes, PKCE, token authentication, audience, NameID format, algorithms, signed\nassertions and requests, profile mapping, and your own provider fields.",[210,602,604],{"id":603},"what-to-give-the-identity-provider","What to give the identity provider",[189,606,607],{},"Each provider on the tab shows the addresses its identity provider needs, with copy buttons:",[465,609,610,620],{},[468,611,612,615,616,619],{},[471,613,614],{},"OIDC:"," the redirect URI, ",[223,617,618],{},"https:\u002F\u002Fyour-site\u002Fapi\u002Fauth\u002Fsso\u002Fcallback\u002F\u003Cprovider id>",".",[468,621,622,625,626,629],{},[471,623,624],{},"SAML:"," the ACS URL, ",[223,627,628],{},"https:\u002F\u002Fyour-site\u002Fapi\u002Fauth\u002Fsso\u002Fsaml2\u002Fsp\u002Facs\u002F\u003Cprovider id>",", and a link to the service\nprovider metadata XML.",[210,631,633],{"id":632},"verifying-the-domain","Verifying the domain",[189,635,636,637,639],{},"With ",[223,638,455],{},", a new provider can't sign anyone in until its domains are verified:",[641,642,643,653,656],"ol",{},[468,644,645,646,649,650,619],{},"The tab shows a TXT record to add to each domain's DNS: its name,\n",[223,647,648],{},"_better-auth-token-\u003Cprovider id>.\u003Cdomain>",", and ",[471,651,652],{},"Show the value",[468,654,655],{},"Add the record, and wait for DNS to update.",[468,657,658,659,619],{},"Press ",[471,660,661],{},"Verify domain",[210,663,665],{"id":664},"editing-and-deleting","Editing and deleting",[189,667,668],{},"Edit a provider from its card; fields left empty, like secrets and certificates, stay as they are. Deleting asks\nfirst: its members can't sign in through it any more.",[201,670,502],{"id":671},"who-joins-as-what",[189,673,674,675,678,679,681,682,685],{},"Members who sign in through their organization's provider join it with ",[223,676,677],{},"organizationProvisioning.defaultRole",". To\ndecide per person, from what the provider says about them, write ",[223,680,497],{}," in a file and point ",[223,683,684],{},"serverOptions"," at it:",[687,688,689,784],"code-group",{},[215,690,692],{"className":247,"code":691,"filename":249,"language":250,"meta":221,"style":221},"export default defineNuxtConfig({\n  betterAuthUi: {\n    sso: {\n      enabled: true,\n      organizationProvisioning: { defaultRole: 'member' },\n      serverOptions: '.\u002Fserver\u002Fauth\u002Fsso.ts'\n    }\n  }\n})\n",[223,693,694,706,714,722,732,755,770,774,778],{"__ignoreMap":221},[226,695,696,698,700,702,704],{"class":228,"line":229},[226,697,258],{"class":257},[226,699,261],{"class":257},[226,701,265],{"class":264},[226,703,269],{"class":268},[226,705,273],{"class":272},[226,707,708,710,712],{"class":228,"line":276},[226,709,280],{"class":279},[226,711,283],{"class":272},[226,713,286],{"class":272},[226,715,716,718,720],{"class":228,"line":289},[226,717,315],{"class":279},[226,719,283],{"class":272},[226,721,286],{"class":272},[226,723,724,726,728,730],{"class":228,"line":312},[226,725,325],{"class":279},[226,727,283],{"class":272},[226,729,306],{"class":305},[226,731,332],{"class":272},[226,733,734,737,739,741,744,746,748,751,753],{"class":228,"line":322},[226,735,736],{"class":279},"      organizationProvisioning",[226,738,283],{"class":272},[226,740,297],{"class":272},[226,742,743],{"class":279}," defaultRole",[226,745,283],{"class":272},[226,747,421],{"class":272},[226,749,750],{"class":236},"member",[226,752,410],{"class":272},[226,754,309],{"class":272},[226,756,757,760,762,764,767],{"class":228,"line":335},[226,758,759],{"class":279},"      serverOptions",[226,761,283],{"class":272},[226,763,421],{"class":272},[226,765,766],{"class":236},".\u002Fserver\u002Fauth\u002Fsso.ts",[226,768,769],{"class":272},"'\n",[226,771,772],{"class":228,"line":342},[226,773,356],{"class":272},[226,775,776],{"class":228,"line":353},[226,777,362],{"class":272},[226,779,780,782],{"class":228,"line":359},[226,781,368],{"class":272},[226,783,371],{"class":268},[215,785,788],{"className":247,"code":786,"filename":787,"language":250,"meta":221,"style":221},"export default {\n  organizationProvisioning: {\n    getRole: async ({ userInfo }) =>\n      userInfo.attributes?.department === 'IT' ? 'admin' : 'member'\n  }\n}\n","server\u002Fauth\u002Fsso.ts",[223,789,790,798,807,831,876,880],{"__ignoreMap":221},[226,791,792,794,796],{"class":228,"line":229},[226,793,258],{"class":257},[226,795,261],{"class":257},[226,797,286],{"class":272},[226,799,800,803,805],{"class":228,"line":276},[226,801,802],{"class":279},"  organizationProvisioning",[226,804,283],{"class":272},[226,806,286],{"class":272},[226,808,809,812,814,818,821,825,828],{"class":228,"line":289},[226,810,811],{"class":264},"    getRole",[226,813,283],{"class":272},[226,815,817],{"class":816},"spNyl"," async",[226,819,820],{"class":272}," ({",[226,822,824],{"class":823},"sHdIc"," userInfo",[226,826,827],{"class":272}," })",[226,829,830],{"class":816}," =>\n",[226,832,833,836,838,841,844,847,850,852,855,857,860,862,865,867,870,872,874],{"class":228,"line":312},[226,834,835],{"class":268},"      userInfo",[226,837,619],{"class":272},[226,839,840],{"class":268},"attributes",[226,842,843],{"class":272},"?.",[226,845,846],{"class":268},"department ",[226,848,849],{"class":272},"===",[226,851,421],{"class":272},[226,853,854],{"class":236},"IT",[226,856,410],{"class":272},[226,858,859],{"class":272}," ?",[226,861,421],{"class":272},[226,863,864],{"class":236},"admin",[226,866,410],{"class":272},[226,868,869],{"class":272}," :",[226,871,421],{"class":272},[226,873,750],{"class":236},[226,875,769],{"class":272},[226,877,878],{"class":228,"line":322},[226,879,362],{"class":272},[226,881,882],{"class":228,"line":335},[226,883,884],{"class":272},"}\n",[189,886,887,888,891,892,891,895,332,898,901,902,619],{},"The same file takes Better Auth's other function options: ",[223,889,890],{},"provisionUser",", ",[223,893,894],{},"resolveUser",[223,896,897],{},"guardProviderMutation",[223,899,900],{},"resolvePrivateKey"," and ",[223,903,904],{},"defaultSSO",[201,906,908],{"id":907},"in-the-admin","In the admin",[189,910,911,912,914,915,919],{},"A ",[471,913,91],{}," page lists every provider: its protocol, domains and whether they're verified, its organization,\nand who added it. It never shows secrets. The ",[193,916,918],{"href":917},"\u002Fadmin#configuration-page","configuration page"," shows whether SSO and\ndomain verification are on.",[201,921,923],{"id":922},"options","Options",[925,926,927,933,946,960,972,978,984,996,1007,1031,1044],"field-group",{},[928,929],"field",{"name":930,"type":931,"default":932},"enabled","boolean","false",[928,934,936],{"name":455,"type":935,"default":932},"boolean | object",[189,937,938,939,942,943,503],{},"New providers work once a DNS TXT record proves the domain. ",[223,940,941],{},"{ tokenPrefix }"," changes the record's prefix\n(",[223,944,945],{},"better-auth-token",[928,947,950],{"name":948,"type":949},"organizationProvisioning","object",[189,951,952,955,956,959],{},[223,953,954],{},"{ defaultRole: 'member' }"," is the role people join with; ",[223,957,958],{},"{ disabled: true }"," stops them joining.",[928,961,965],{"name":962,"type":963,"default":964},"providersLimit","number","10",[189,966,967,968,971],{},"Providers a user can register. ",[223,969,970],{},"0"," turns registering off.",[928,973,975],{"name":974,"type":931,"default":932},"disableImplicitSignUp",[189,976,977],{},"SSO sign-ins don't create new users unless sign-up is requested.",[928,979,981],{"name":980,"type":931,"default":932},"defaultOverrideUserInfo",[189,982,983],{},"Every sign-in updates the user's profile from the provider.",[928,985,987],{"name":986,"type":931,"default":932},"provisionUserOnEveryLogin",[189,988,989,990,992,993,995],{},"Run ",[223,991,890],{}," (from ",[223,994,684],{},") on every sign-in, not just the first.",[928,997,1000],{"name":998,"type":999},"redirectURI","string",[189,1001,1002,1003,1006],{},"One redirect URI for every OIDC provider, for example ",[223,1004,1005],{},"\u002Fsso\u002Fcallback",". By default each has its own.",[928,1008,1010],{"name":1009,"type":949},"saml",[189,1011,1012,1013,891,1016,891,1019,891,1022,332,1025,891,1028,619],{},"SAML security: ",[223,1014,1015],{},"enableInResponseToValidation",[223,1017,1018],{},"allowIdpInitiated",[223,1020,1021],{},"requestTTL",[223,1023,1024],{},"clockSkew",[223,1026,1027],{},"requireTimestamps",[223,1029,1030],{},"idpInitiatedCallbackUrl",[928,1032,1034],{"name":1033,"type":949},"schema",[189,1035,1036,1037,1039,1040,1043],{},"Better Auth's schema options for the ",[223,1038,445],{}," table, including your own fields (",[223,1041,1042],{},"additionalFields","), which the\nSSO tab shows and edits.",[928,1045,1046],{"name":684,"type":999},[189,1047,1048],{},"A file with more of the plugin's options, for those that are functions.",[1050,1051,1052],"note",{},[189,1053,1054,1059,1060,1063],{},[193,1055,1058],{"href":1056,"rel":1057},"https:\u002F\u002Fbetter-auth.com\u002Fdocs\u002Finfrastructure\u002Fgetting-started",[197],"Better Auth Infrastructure"," (",[223,1061,1062],{},"@better-auth\u002Finfra",") is a\nhosted, paid service with its own self-service SSO dashboard. The module doesn't add it; if you use it, add its\nplugins to your auth config yourself.",[1065,1066,1067],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}",{"title":221,"searchDepth":229,"depth":276,"links":1069},[1070,1071,1072,1078,1079,1080],{"id":203,"depth":276,"text":204},{"id":459,"depth":276,"text":460},{"id":506,"depth":276,"text":507,"children":1073},[1074,1075,1076,1077],{"id":517,"depth":289,"text":518},{"id":603,"depth":289,"text":604},{"id":632,"depth":289,"text":633},{"id":664,"depth":289,"text":665},{"id":671,"depth":276,"text":502},{"id":907,"depth":276,"text":908},{"id":922,"depth":276,"text":923},"Organizations sign their members in through their own identity provider, with OIDC or SAML 2.0.","md",null,{},{"icon":94},{"title":91,"description":1081},"VJ4CUkBZqCiVj9nHH3xSCMa73SslNAr76uXpeIOhvfs",[1089,1091],{"title":86,"path":87,"stem":88,"description":1090,"icon":89,"children":-1},"Your own resources, roles in nuxt.config, and roles each organization makes.",{"title":101,"path":97,"stem":98,"description":1092,"icon":102,"children":-1},"The admin dashboard at \u002Fadmin, where staff manage users through Better Auth's Admin plugin.",1793019842936]