Context
End customers (members) are a distinct population from console users; Softcrum must be the identity authority (D4) while embedded/headless integrations keep their own login UX.Decision
Members live in a SEPARATE Better Auth realm (own tables/config; zero session or token overlap with the organizational realm). Entry modes: (a) native OTP/magic link via Resend; (b) token exchange: tenant backend signs a per-tenant-key JWT assertion (external_id, ≤5 min, single-use jti) →POST /v1/core/auth/token-exchange → Softcrum member token (scoped: member:read, member:redeem, member:referral). Every authenticated member maps 1:1 to a core.contacts row.
Consequences
- Softcrum remains authority; contacts always exist; third parties keep their UX. + No privilege-escalation path member→user by construction. − Two auth realms to operate; token-exchange key rotation tooling required.