# Guides (/docs/guides)

> Task-oriented walkthroughs for building, securing, extending, running, migrating, and upgrading applications on Better IAM, plus a cookbook of short recipes.



Guides take one outcome from an empty starting point to working, verified code. Each one lists what you will build
and its prerequisites, then walks through numbered steps with complete files, every import shown and every file
named by its path. Each ends with a way to check that it works, the failures you are most likely to hit, and where
to go next.

Use a guide when you know what you want to build. To learn how a feature works, or to look up every option of an
API, start from [Concepts](/docs/concepts), the feature pages, or the [Reference](/docs/reference) instead; guides
link to them wherever a step relies on them.

## Build [#build]

  - [Build a multi-tenant B2B SaaS](/docs/guides/b2b-saas): Organizations, owner and member invitations, product roles, per-organization sign-in policy, an organization switcher, and authorized routes in Next.js.

  - [SAML single sign-on with Okta](/docs/guides/enterprise-sso-okta): One organization signs in with its Okta through a tenant-managed SAML connection, with a verified domain and just-in-time accounts.

  - [SCIM provisioning with Entra ID and Okta](/docs/guides/scim-provisioning): A customer's directory creates, updates, and deactivates its people, and its groups grant roles.

  - [Protect an API with OAuth](/docs/guides/protect-an-api): Issue OAuth access tokens and verify them in a separate API service.

  - [Secure an MCP server](/docs/guides/secure-an-mcp-server): OAuth authorization and per-tool permissions for a Model Context Protocol server.

  - [AI agents that act for users](/docs/guides/ai-agents-on-behalf-of-users): Give an AI agent its own identity, delegated access, and human confirmations.

## Access and compliance [#access-and-compliance]

  - [Row-level data filtering](/docs/guides/row-level-data-filtering): Turn authorization policies into database filters for Prisma, Drizzle, and SQL.

  - [Just-in-time admin access](/docs/guides/just-in-time-admin-access): Replace standing admin rights with time-boxed, approved elevation.

  - [Audit readiness for SOC 2](/docs/guides/soc2-audit-readiness): Access reviews, audit evidence, and change control that auditors ask for.

  - [Usage-based billing](/docs/guides/usage-based-billing): Meter usage, apply rate cards, and invoice each tenant.

## Extend and test [#extend-and-test]

  - [Create your first extension](/docs/guides/create-an-extension): Add your own API methods, events, and checks to Better IAM.

  - [Write a database adapter](/docs/guides/custom-database-adapter): Implement the storage adapter contract and pass the conformance suite.

  - [Test your integration](/docs/guides/testing): Unit and end-to-end tests for code that uses Better IAM.

## Production [#production]

  - [Production checklist](/docs/guides/production-checklist): Everything to check before real users sign in.

  - [Optimize performance](/docs/guides/performance): Fast authorization checks, sign-in, and storage at scale.

  - [Run in multiple regions](/docs/guides/multi-region): Pin organizations to regions and route sign-in to the right deployment.

## Migrate and upgrade [#migrate-and-upgrade]

  - [Migration guides](/docs/guides/migration): Move users, organizations, and permissions from another identity provider.

  - [From Auth0](/docs/guides/migration/from-auth0): Users, organizations, roles, and connections.

  - [From Clerk](/docs/guides/migration/from-clerk): Users, organizations, and roles.

  - [From WorkOS](/docs/guides/migration/from-workos): Organizations, SSO connections, and directories.

  - [From Better Auth](/docs/guides/migration/from-better-auth): Users, organizations, members, and roles.

  - [From Auth.js](/docs/guides/migration/from-authjs): Users and accounts from Auth.js (NextAuth).

  - [From Keycloak](/docs/guides/migration/from-keycloak): Realms, users, groups, and roles.

  - [Upgrade guides](/docs/guides/upgrade): Breaking changes and upgrade steps between releases.

  - [Upgrade to 0.3](/docs/guides/upgrade/v0-3): The steps from Better IAM 0.2 to 0.3.

## Cookbook [#cookbook]

Recipes are short, copy-ready answers to one question each, grouped by topic.

  - [Recipes](/docs/guides/recipes): Every recipe, by topic.

  - [Sharing and access questions](/docs/guides/recipes/sharing-and-reviews): Relationships, who can do what, policy tests and rollback, time-bound roles, and guardrails.

  - [Sign-in and devices](/docs/guides/recipes/sign-in-and-devices): Per-organization MFA and method rules, trusted browsers, device lists, and sign-out everywhere.

  - [Support and privacy](/docs/guides/recipes/support-and-privacy): View as a member, export everything stored about a person, and render the outbox's emails.

  - [Tenancy and limits](/docs/guides/recipes/tenancy-and-limits): Plan limits and metering, bulk onboarding, migrations, and libSQL or Turso storage.

  - [Access lifecycle](/docs/guides/recipes/access-lifecycle): Approved elevation, contractor expiry, API key hygiene, configuration as code, and offboarding.

  - [Operations recipes](/docs/guides/recipes/operations): Audit chain verification and archiving, assertions, latency, and webhook redelivery.