Guides
Task-oriented walkthroughs for building, securing, extending, running, migrating, and upgrading applications on Better IAM, plus a cookbook of short recipes.
Guides take one outcome from an empty starting point to working, verified code. Each one lists what you will build and its prerequisites, then walks through numbered steps with complete files, every import shown and every file named by its path. Each ends with a way to check that it works, the failures you are most likely to hit, and where to go next.
Use a guide when you know what you want to build. To learn how a feature works, or to look up every option of an API, start from Concepts, the feature pages, or the Reference instead; guides link to them wherever a step relies on them.
Build
Organizations, owner and member invitations, product roles, per-organization sign-in policy, an organization switcher, and authorized routes in Next.js.
SAML single sign-on with OktaOne organization signs in with its Okta through a tenant-managed SAML connection, with a verified domain and just-in-time accounts.
SCIM provisioning with Entra ID and OktaA customer's directory creates, updates, and deactivates its people, and its groups grant roles.
Protect an API with OAuthIssue OAuth access tokens and verify them in a separate API service.
Secure an MCP serverOAuth authorization and per-tool permissions for a Model Context Protocol server.
AI agents that act for usersGive an AI agent its own identity, delegated access, and human confirmations.
Access and compliance
Turn authorization policies into database filters for Prisma, Drizzle, and SQL.
Just-in-time admin accessReplace standing admin rights with time-boxed, approved elevation.
Audit readiness for SOC 2Access reviews, audit evidence, and change control that auditors ask for.
Usage-based billingMeter usage, apply rate cards, and invoice each tenant.
Extend and test
Add your own API methods, events, and checks to Better IAM.
Write a database adapterImplement the storage adapter contract and pass the conformance suite.
Test your integrationUnit and end-to-end tests for code that uses Better IAM.
Production
Everything to check before real users sign in.
Optimize performanceFast authorization checks, sign-in, and storage at scale.
Run in multiple regionsPin organizations to regions and route sign-in to the right deployment.
Migrate and upgrade
Move users, organizations, and permissions from another identity provider.
From Auth0Users, organizations, roles, and connections.
From ClerkUsers, organizations, and roles.
From WorkOSOrganizations, SSO connections, and directories.
From Better AuthUsers, organizations, members, and roles.
From Auth.jsUsers and accounts from Auth.js (NextAuth).
From KeycloakRealms, users, groups, and roles.
Upgrade guidesBreaking changes and upgrade steps between releases.
Upgrade to 0.3The steps from Better IAM 0.2 to 0.3.
Cookbook
Recipes are short, copy-ready answers to one question each, grouped by topic.
Every recipe, by topic.
Sharing and access questionsRelationships, who can do what, policy tests and rollback, time-bound roles, and guardrails.
Sign-in and devicesPer-organization MFA and method rules, trusted browsers, device lists, and sign-out everywhere.
Support and privacyView as a member, export everything stored about a person, and render the outbox's emails.
Tenancy and limitsPlan limits and metering, bulk onboarding, migrations, and libSQL or Turso storage.
Access lifecycleApproved elevation, contractor expiry, API key hygiene, configuration as code, and offboarding.
Operations recipesAudit chain verification and archiving, assertions, latency, and webhook redelivery.
Better IAM is created by Sean Filimon
Last updated
LDAP gatewaynew
Serve each organization's people and groups over read-only LDAPv3, with password and API key binds that go through Better IAM sign-in.
Build a multi-tenant B2B SaaS
Build a Next.js B2B app where each customer is an organization with its own owner, invited members, product roles, sign-in policy, organization switcher, and authorized routes.