Better Enrollment

The two modes

Invite-only and open, and how auto-detection picks one.

Better Enrollment's mode accepts "auto" (default), "invite-only", or "open". In auto the plugin inspects your config at startup: everything closed means invite-only, everything open means open, and a mixed config throws with a message naming each path, asking you to set mode explicitly.

Your responsibility, for now

Detection sees emailAndPassword, socialProviders, and the magic-link plugin. Sign-up paths added by other plugins (email OTP, passkey, phone number, anonymous, generic OAuth) are invisible to it and are NOT blocked at runtime, so any of them silently bypasses invite-only mode. If you use one, you must close or remove its sign-up path yourself. A runtime backstop that rejects non-invite user creation is on the roadmap.

The two configurations

All sign-up routes are disabled and the plugin creates users through Better Auth's internal adapter. Setting it explicitly while a sign-up path is still open throws at init; allowOpenSignup: true downgrades that to a warning, and the guarantee becomes per-email: pending invites still lock their own address while everyone else signs up freely.

auth.ts
emailAndPassword: {
  enabled: true,
  disableSignUp: true
},
plugins: [admin(), betterEnrollment({ /* ... */ })],

Where to go next

Invites

Kinds, delivery types, and how to create each one.

Quick Start

Set up Better Enrollment step by step, for a closed app or open sign-up.

Last updated on

How it works

The lifecycle of an invitation, from create to redeem.

Magic linksnew

Passwordless invites for magic-link apps, from setup to the invite page.

On this page

The two configurationsWhere to go next