# Introduction (/docs/introduction) > Better IAM is an embeddable TypeScript platform for authentication, identity provisioning, and access management, running in your app on your own database. Better IAM gives an application the identity layer that is usually bought as a hosted service: multi-tenant organizations, sign-in with every modern method, fine-grained authorization, governance, and enterprise federation. It is a library, not a SaaS. It runs in your process, stores its data in your PostgreSQL, SQLite, or libSQL database, and exposes a typed API to your server and browser code. You create one instance with `betterIam()`, giving it a database, a deployment secret, and the URL it is served from, and import that instance wherever your server code needs identity or authorization: ```ts title="iam.ts" import { betterIam } from 'better-iam'; import { sqliteAdapter } from 'better-iam/adapter-sqlite'; export const iam = betterIam({ database: sqliteAdapter({ filename: './iam.db' }), secret: process.env.BETTER_IAM_SECRET!, baseURL: 'https://identity.example.com', }); ``` ## Why it exists [#why-it-exists] Most business software eventually needs the same identity features: customers are organizations rather than individuals, each organization wants its own roles and its own single sign-on, security teams ask who can do what and who changed it, and enterprise buyers expect SCIM provisioning, MFA policies, and an audit trail. Teams usually assemble this from several services: a hosted sign-in provider, a separate authorization service, and later a governance or provisioning tool. That works, but it has costs: * **Your identity data lives somewhere else.** People, sessions, and roles sit in a vendor's database, so every permission check is a network call, and keeping that data consistent with your own records is your problem. * **Authorization is disconnected from your data.** Deciding "may Alice approve this invoice?" needs the invoice's owner and amount, which the external service does not have. * **Each service has its own model.** Tenants, roles, and audit logs are defined three times and reconciled by hand. Better IAM takes the other approach: it is a library that runs inside your application and stores everything in your database, in the same transactions as your own writes. One tenant model, one authorization engine, and one tamper-evident audit log cover sign-in, access decisions, governance, and federation, all behind a single typed API. > **When you may not need it.** If your application has individual users and no organizations, roles, or enterprise customers, a simpler authentication library is enough. Better IAM earns its place when access control, multi-tenancy, and auditability are part of the product. [Comparison](/docs/comparison) sets it against hosted identity providers, authentication libraries, authorization services, and Keycloak. ## What it covers [#what-it-covers] - [Tenants and organizations](/docs/concepts/tenants-and-identities): Tenant trees with isolated identity directories, invitations, sign-in aliases, and platform root administration. - [Authentication](/docs/authentication): Passwords, passkeys, magic links, email and SMS codes, TOTP, trusted devices, and per-tenant sign-in policies. - [Authorization](/docs/authorization): Roles, versioned JSON policies with conditions and variables, relationships (ReBAC), boundaries, and reverse queries. - [Privileged access](/docs/features/privileged-access): Just-in-time elevation with approvals, access packages, temporary bindings, and configuration as code. - [Governance](/docs/features/governance): Access reviews, certification campaigns, separation of duties, role mining, invariants, change previews, privacy and consent, lifecycle workflows, compliance evidence, and an app catalog. - [Security services](/docs/features/secrets-and-keys): Tenant keys, a secrets vault, tokenization, a private CA, SSH certificates, device posture, and identity threat detection. - [Federation](/docs/federation): OAuth/OIDC sign-in and provider, SAML SSO, SCIM in and out, Shared Signals (CAEP/RISC) both ways, verifiable credentials, and an LDAP gateway. - [Audit and events](/docs/concepts/events): A tamper-evident, hash-chained audit log with webhooks, subscribers, metrics, and spans. - [Every framework](/docs/integrations): A typed client plus Next.js, React, Vue, Nuxt, SvelteKit, React Router, NestJS, Express, Hono, and Fastify integrations. ## How it fits together [#how-it-fits-together] Every operation, whether it comes from a browser, a server action, the CLI, or a SCIM connector, runs through the same pipeline: 1. **Resolve the credential.** A session cookie, bearer token, API key, or assumed role becomes a principal: who is calling, how they signed in, and whether they used MFA. 2. **Authorize.** The principal's roles, policies, and boundaries in that tenant decide whether the action is allowed. 3. **Apply the change in one transaction** in your database, so a failure leaves nothing half done. 4. **Record it.** A hash-chained audit event is appended in the same transaction and then fans out to webhooks, in-process subscribers, and metrics. Because every API call takes this one path, no API call bypasses authorization or the audit log, and an administrator using the console is held to the same rules as your own API calls. Deployment operations that take no credential (migrations, root bootstrap, scheduled jobs) run from your server or the CLI, not over the API. ## Who makes it [#who-makes-it] Better IAM is created and maintained by Sean Filimon. Every package is open source under the Apache License 2.0. ## How these docs are organized [#how-these-docs-are-organized] | Section | What it covers | Start with | | -------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | | Get Started | What Better IAM is, how it compares, installing it, and a first working setup | [Installation](/docs/installation), [Quickstart](/docs/quickstart) | | Concepts | The architecture, tenants and identities, resources, the API surface, events, errors, and extensions | [Architecture overview](/docs/concepts) | | Authentication | Sign-in methods, sessions, MFA, passkeys, API keys, tokens, and per-tenant sign-in policies | [Authentication](/docs/authentication) | | Authorization | Roles, policies, conditions, relationships, reverse queries, and data filtering | [Authorization](/docs/authorization) | | Databases | The PostgreSQL, SQLite, and libSQL adapters, migrations, and the schema | [Databases](/docs/databases) | | Integrations | The typed client and every framework integration | [Integrations](/docs/integrations) | | Features | Optional modules you turn on with options: privileged access, governance, secrets and keys, AI agents, billing, and more | [Features](/docs/features) | | Federation | OAuth/OIDC, SAML, SCIM, Shared Signals, verifiable credentials, and LDAP | [Federation](/docs/federation) | | Guides | Task-oriented walkthroughs, migration from other providers, upgrade notes, and a recipes cookbook | [Guides](/docs/guides) | | Operations | Deployment, secrets, scheduled jobs, observability, and security | [Operations](/docs/operations) | | AI Resources | Ways to give coding agents these docs: MCP, llms.txt, agent skills, and prompts | [Use the docs with AI](/docs/ai) | | Reference | Generated reference for every API method, option, error code, CLI command, and export | [Reference](/docs/reference) | ## Docs for AI [#docs-for-ai] These docs are written to be read by coding agents as well as people: every page is available as Markdown, the site publishes `/llms.txt` and `/llms-full.txt`, and a read-only MCP server lets an assistant search pages and look up API methods, exports, and error codes while it works. See [Use the docs with AI](/docs/ai) to connect Claude Code, Cursor, or VS Code. ## Where to go next [#where-to-go-next] - [Installation](/docs/installation): Install the package, connect a database, and mount the handler in your framework. - [Quickstart](/docs/quickstart): Bootstrap the root, create an organization, and make your first authorization check. - [Comparison](/docs/comparison): How Better IAM differs from hosted providers, authentication libraries, and authorization services. - [Concepts](/docs/concepts): How tenants, identities, resources, and the request pipeline fit together. - [Guides](/docs/guides): Build a B2B SaaS, protect an API, add enterprise SSO, and migrate from another provider. - [Policy playground](/playground): Evaluate policy documents in your browser with the real policy engine.