The two modes
Invite-only and open, and how auto-detection picks one.
Better Enrollment's mode accepts "auto" (default), "invite-only", or "open". In auto the plugin inspects your config at startup: everything closed means invite-only, everything open means open, and a mixed config throws with a message naming each path, asking you to set mode explicitly.
Your responsibility, for now
Detection only sees emailAndPassword and socialProviders. Sign-up paths added by other plugins
(magic link, email OTP, passkey, phone number, anonymous, generic OAuth) are invisible to it and
are NOT blocked at runtime, so any of them silently bypasses invite-only mode. If you use one, you
must close or remove its sign-up path yourself. A runtime backstop that rejects non-invite user
creation is on the roadmap.
The two configurations
All sign-up routes are disabled and the plugin creates users through Better Auth's internal adapter. Setting it explicitly while a sign-up path is still open throws at init; allowOpenSignup: true downgrades that to a warning, and the guarantee becomes per-email: pending invites still lock their own address while everyone else signs up freely.
emailAndPassword: {
enabled: true,
disableSignUp: true
},
plugins: [admin(), betterEnrollment({ /* ... */ })],Last updated on