Alpha Bros has published @alphabros/enterprise, an MIT-licensed npm package at version 0.1.0 that bundles SSO, SCIM, two-factor authentication, passkeys, API keys, an audit log and an admin portal into an embeddable set of server, schema, client and portal modules. The authors describe it as pilot-grade: it has 397 tests, no production tenant at the time of publication, and breaking changes are expected before 1.0.
The account comes from a first-person article by the Alpha Bros team, dated 16 September 2026 on Dev.to and reproduced on a secondary hosting page. Every technical, security and maturity statement below is the publisher’s claim. It is not independent validation of the code, the tests or the security posture, so verify those against the package registry and repository before relying on them.
As an Amazon Associate I earn from qualifying purchases.
Why the team built a package instead of repeating the work
The authors say they run eight products, seven of which authenticate with better-auth. Each product needed the same enterprise features once a customer asked for them: SAML or OIDC single sign-on, directory provisioning, enforced security policy and an audit trail. The team had two alternatives they rejected: rebuilding the work in every product, or paying a US vendor per connection for hosted identity services. They chose one embeddable package that each product installs and configures.
The article’s framing is commercial as well as technical. Its opening line describes the problem as a choice many small B2B products face: “If your product has been putting off the enterprise tier because it’s a tax with no upside for your users”. That is the publisher’s wording, not audience research, but it explains why the package is designed to be reused rather than tailored to one codebase.
#1 Best Overall
What the package contains
The package exposes four entry points. Each one is a separate import path, so an application only pulls in the layer it needs.
| Entry point | What the article says it provides |
|---|---|
/server |
better-auth organization, SSO, SCIM, admin, two-factor, passkey and API-key plugins; a hash-chained audit log; an organization policy engine |
/schema |
Drizzle table definitions, a plain SQL migration, and a CLI with migration, verification and audit-verification commands |
/client |
Matching client-side plugins, including discoverHomeRealm(email), which routes a user to their identity provider after email entry |
/portal |
Seven Lit Web Components for member management, SSO setup, SCIM tokens, security policy, API keys, and audit review and export |
Server: identity and policy
The server entry point is where most of the enterprise behaviour lives. According to the article, it covers:
- SSO: SAML 2.0 and OIDC, with DNS-based domain verification and just-in-time provisioning of users on first sign-in.
- SCIM: provisioning of users and groups.
- Policy controls: requiring two-factor authentication, enforcing SSO with a break-glass owner account, setting session lifetime, restricting allowed sign-in methods, and mapping identity-provider groups to application roles.
- Audit log: a hash-chained record of security events, with the limitations described in the audit section below.
Schema and CLI
The schema entry point gives each product the database layer. Tables are defined with Drizzle, and a plain SQL migration is provided for teams that manage migrations outside Drizzle. The bundled CLI handles migration, verification and audit verification. The article does not list the exact command names, so check the package’s own documentation for the current syntax.
Client and portal
The client entry point mirrors the server plugins so that the login screens can call the same identity flows. The portal is a set of seven Lit Web Components that give customer administrators a self-service interface. The article says these components work in SvelteKit, Astro, Next and plain HTML, and that they can be styled with --ab-* CSS variables. Those framework claims are the authors’ statements and have not been independently tested here.
Rank #2
Architecture: each product keeps its own identity boundary
The design choice that most affects adoption is that the package does not create a shared login across products. Each application keeps its own users, its own database and its own identity-provider connections. The authors say they deliberately avoided a central identity service because it would become a single point of failure and would require migrating users.
They are explicit about the trade-off. “A central identity plane is a single point of failure and a user migration; we’ll get there later, and the data model already leaves room for it (studio_ref columns, per-organization SSO config), but not as the first step.” That sentence is from the Alpha Bros article, written by its authors. The article does not name an individual author in that passage.
For a team, the practical consequence is that each application is its own tenant boundary. A customer who uses two Alpha Bros products will not get single sign-on across both.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Billing and entitlements remain your code
The package does not contain billing, pricing or plan logic. The integrating application supplies a resolveEntitlements(orgId) function, and the package uses its result to decide whether a given organization may reach the portal endpoints. The article states plainly that there is no Stripe integration and no pricing page in the package.
Rank #3
That split matters for planning. Choosing a plan tier, deciding which plan unlocks SSO, and handling the billing webhook are all tasks the product team still owns. The package only checks the answer it is given.
Setting up the package
The article’s example setup connects better-auth to a Drizzle adapter and reads its encryption secret from an environment variable. Before going live, the workflow the article describes includes:
- Running the schema migration and then the verification command from the bundled CLI.
- Supplying a secrets key from the environment rather than from source code.
- Implementing
resolveEntitlements(orgId)for each product. - Configuring at least one identity provider per organization, with DNS domain verification completed before enabling just-in-time provisioning.
- Checking the audit-verification command against a test database before relying on the audit log.
Deployment: Cloudflare Workers and SAML
The authors say four of their products deploy on Cloudflare Workers. Before building the package, they tested samlify signing and verification, including encrypted assertions, under the nodejs_compat compatibility flag. That is a reported implementation experience, not an independent compatibility benchmark. If you plan to run SAML on Workers, test your own identity provider’s assertions in the same runtime configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Version constraints
- The package is pinned to better-auth 1.6.33, as stated in the article.
- The article says better-auth 1.7’s SSO and SCIM plugins introduce a breaking peer-dependency change, so the package stays on the 1.6 line until the authors’ own product fleet moves.
- An advisory covering the 1.6 line is documented in the repository’s
docs/security.md. Read it before choosing a version.
Security review and supply-chain claims
The publisher says it performed a repository and supply-chain audit, followed by a code audit, before the first publish. It then reviewed the branch after fixes. The findings it reports, all described by the authors, are:
Rank #4
- Used Book in Good Condition
- Cross-tenant injection into the audit log.
- An owner-demotion issue triggered by SCIM group changes.
- A retention purge that broke the audit hash chain.
- An encryption key that was defined but never used.
The article says regression tests reproduce each original issue. It also states that the production dependency tree consists of a single package, zod, and that releases go through CI using npm Trusted Publishing with provenance. These are the authors’ claims about their own repository. Confirm the dependency tree and the provenance attestation on the npm registry page for the version you install.
The audit chain: what it proves and what it does not
The audit log is hash-chained, so changes to earlier records break the chain and can be detected when verification runs. The article is explicit about the limit: a user with write access to the database can rewrite the chain. The CLI can recompute it, which means the chain shows tampering under the described model, but it does not stop an attacker who can rewrite both the data and the evidence.
The authors recommend exporting checkpoints of the chain to storage the database operator cannot write to. Without that step, the audit log is tamper-evident only for changes that someone does not also cover up in the database. Treat it as one control among others, not as proof against a compromised database administrator.
Maturity: what the numbers do and do not show
| Figure | Value | Qualification |
|---|---|---|
| Package version | 0.1.0 | Version stated in the article, dated 16 September 2026 |
| Automated tests | 397 | Publisher-reported count at publication; not independently run |
| Production tenants | Zero | Stated at publication; this will change and is not a current figure |
| Products using better-auth | Seven of eight | Publisher-reported; the authors run eight products in total |
| Products on Cloudflare Workers | Four | Publisher-reported deployment target |
| better-auth pin | 1.6.33 | Version stated in the article |
These are product-specific counts from one publisher, not industry statistics or measurements from an external auditor. The article also states that breaking changes are expected before 1.0, and that the package is not yet running in production for any external customer.
Weighing it against other options
The article does not compare the package with alternatives, and it gives no measured cost comparison, so there is no basis for a savings figure. The table below records what the source establishes for the Alpha Bros package. For the other options, the questions to ask are listed beneath it.
| Criterion | Alpha Bros package (per the article) |
|---|---|
| Protocols and provisioning | SAML 2.0 and OIDC for SSO; SCIM for users and groups; just-in-time provisioning |
| Identity boundary | Each product keeps its own users, database and identity-provider connections; no shared login |
| Audit model | Hash-chained log, tamper-evident under the described model; rewritable by a user with database write access |
| Version coupling | Pinned to better-auth 1.6.33; 1.7 requires a change the authors have not yet adopted |
| Billing and entitlements | Supplied by the integrating application through resolveEntitlements(orgId) |
| Maturity | 0.1.0; 397 tests; zero production tenants at publication; breaking changes expected before 1.0 |
| Cost | Not stated in the article |
If you are comparing this package with building in-house, with using better-auth’s plugins directly, or with buying a hosted identity service, ask the same questions of each: how much integration code you must own, where user and identity data live, which protocols and provisioning flows are supported, how audit records are protected, which library versions you are locked to, who patches vulnerabilities, and how mature the code is. The source gives answers to these questions only for the Alpha Bros package.
Before you adopt it
- Confirm the current version, test count and dependency list on the npm registry, since the article’s figures date from 16 September 2026.
- Read
docs/security.mdand the advisory for the 1.6 line. - Pin better-auth to 1.6.33 unless you have reviewed the 1.7 peer change.
- Write
resolveEntitlements(orgId)and test that the portal endpoints deny access when the function returns no entitlement. - Run SAML tests against your own identity providers on your actual runtime, including encrypted assertions.
- Decide how audit checkpoints will be exported and stored outside the application database.
- Plan for breaking changes before 1.0 and budget time for upgrades.
The article is an authored account of a small studio’s decision, and its strongest contribution is the list of design trade-offs it makes explicit. The stated security findings and their fixes give a useful checklist for any embedded auth layer, whether or not you use this package.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The Bottom Line
Treat @alphabros/enterprise as a concrete reference for what an embedded enterprise-auth layer must cover, and as a pilot-stage dependency to evaluate rather than a production-proven one. If you already run better-auth 1.6 and need SAML, SCIM and a tamper-evident audit trail, review the code, the test suite and docs/security.md before adopting it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
