../constitution/founding-constitution.md
⚠️ Reconstructed from the material we have, not recovered. Tags: [derived] is supported by evidence in the repository · [inferred] is deduced · [proposed] is a gap I filled.
Context
Authentication is the classic build-or-buy decision, and for a B2B platform the requirements arrive in a predictable order: password and email first, then MFA, then social login, then enterprise SSO, then being an OAuth provider. Each is unglamorous and each takes longer than expected. [inferred] The hosted options (Auth0, Clerk, WorkOS) deliver all of it immediately and price per monthly active user — which stacks badly on a platform whose own pricing is per marketable contact, since the same growth is billed twice. [inferred]Decision
Better Auth, self-hosted, owning the organizational realm. [derived] Session storage is our database, so a session is a row we can query, revoke and audit like anything else. [inferred] The decision is revisited if MFA, SSO or the OAuth provider prove materially more expensive to build than estimated. ADR-022 records that this trade was weighed again whenidentity was specified, and
reached the same conclusion. [derived]
Consequences
- No per-user pricing on top of our own metering.
- Being an OAuth provider — a first-class product surface — stays ours rather than rented.
- Sessions, roles and audit live in one database with everything else. − MFA, SSO and the OAuth provider are ours to build. FS-IDN-0005, 0007 and 0008 are that work. − Security-sensitive code we maintain. The mitigation is that Better Auth is the maintained part and our layer is thin.