Auth and organizations

Fabric Experiments uses Better Auth through packages/auth and apps/api/src/server/auth.ts.

Enabled capabilities:

• email/password with required verification,
• magic links,
• Google and GitHub OAuth when env vars are present,
• organization plugin,
• API keys with rate limits,
• admin plugin,
• two-factor auth,
• enterprise SAML 2.0 and OIDC SSO,
• organization provisioning on enterprise sign-in,
• SCIM 2.0 user provisioning with hashed provider tokens.

The login page discovers enterprise SSO from the user's work email. SAML assertions require timestamps, SHA-1/deprecated cryptographic algorithms are rejected, InResponseTo/replay validation is enabled, IdP-initiated unsolicited responses are disabled, and clock skew is limited to two minutes. SCIM token creation is organization-scoped and restricted to owners/admins; linking an unrelated pre-existing user by email is disabled.

The database contract for these plugins is in 016_enterprise_identity.sql. SSO/SCIM configuration should be validated with the customer's identity provider in staging before enforcing SSO for an org.

Important env vars

• DATABASE_URL
• BETTER_AUTH_SECRET
• FX_BASE_URL
• FX_TRUSTED_ORIGINS
• RESEND_API_KEY and RESEND_FROM for real email delivery
• FX_EMAIL_TRANSPORT=log only for disposable integration environments where verification messages must be captured by a test runner
• GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
• GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET

Development logs verification messages when no provider is configured. Production fails closed without RESEND_API_KEY; the explicit log transport exists for disposable browser-test stacks and must not be enabled in a customer environment because verification links are credentials.