> ## Documentation Index
> Fetch the complete documentation index at: https://internal.softcrum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ADR-005 — Better Auth for the Organizational Realm

> Status: Proposed (RECONSTRUCTION — requires validation) · Date: 2026-08-17 (reconstructed) Refs: ../constitution/founding-constitution.md.

Status: **Proposed (RECONSTRUCTION — requires validation)** · Date: 2026-08-17 (reconstructed)
Refs: [`../constitution/founding-constitution.md`](/constitution/founding-constitution)

> ⚠️ Reconstructed from the material we have, not recovered. Tags: **\[derived]** is supported by
> evidence in the repository · **\[inferred]** is deduced · **\[proposed]** is a gap I filled.

## Context

Authentication is the classic build-or-buy decision, and for a B2B platform the requirements arrive
in a predictable order: password and email first, then MFA, then social login, then enterprise SSO,
then being an OAuth provider. Each is unglamorous and each takes longer than expected. **\[inferred]**

The hosted options (Auth0, Clerk, WorkOS) deliver all of it immediately and price per monthly active
user — which stacks badly on a platform whose own pricing is per marketable contact, since the same
growth is billed twice. **\[inferred]**

## Decision

**Better Auth, self-hosted, owning the organizational realm.** \[derived]

Session storage is our database, so a session is a row we can query, revoke and audit like anything
else. \[inferred]

The decision is revisited if MFA, SSO or the OAuth provider prove materially more expensive to build
than estimated. ADR-022 records that this trade was weighed again when `identity` was specified, and
reached the same conclusion. \[derived]

## Consequences

* No per-user pricing on top of our own metering.
* Being an OAuth *provider* — a first-class product surface — stays ours rather than rented.
* Sessions, roles and audit live in one database with everything else.
  − MFA, SSO and the OAuth provider are ours to build. FS-IDN-0005, 0007 and 0008 are that work.
  − Security-sensitive code we maintain. The mitigation is that Better Auth is the maintained part and
  our layer is thin.

## What I could not determine

Whether the original ADR also covered the member realm, or whether that arrived later with ADR-010.
The phrasing of ADR-010 ("a SEPARATE Better Auth realm") suggests this one covered only the
organizational side. **\[inferred]**