> ## Documentation Index
> Fetch the complete documentation index at: https://internal.softcrum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ADR-010 — Member Identity: Separate Better Auth Realm + Token Exchange

> End customers (members) are a distinct population from console users; Softcrum must be the identity authority (D4) while embedded/headless integrations keep their own login UX.

Status: Proposed · Refs: D4, DEC-D5, security-amendments

## Context

End customers (members) are a distinct population from console users; Softcrum must be the identity authority (D4) while embedded/headless integrations keep their own login UX.

## Decision

Members live in a SEPARATE Better Auth realm (own tables/config; zero session or token overlap with the organizational realm). Entry modes: (a) native OTP/magic link via Resend; (b) token exchange: tenant backend signs a per-tenant-key JWT assertion (external\_id, ≤5 min, single-use jti) → `POST /v1/core/auth/token-exchange` → Softcrum member token (scoped: member:read, member:redeem, member:referral). Every authenticated member maps 1:1 to a `core.contacts` row.

## Consequences

* Softcrum remains authority; contacts always exist; third parties keep their UX. + No privilege-escalation path member→user by construction. − Two auth realms to operate; token-exchange key rotation tooling required.