@quickback-dev/better-auth-subscriptions

Better Auth plugin for subscription management (tiers, checkout, portal) with optional org-aware access checks.

Endpoints

• GET /auth/v1/subscriptions/tiers (public)
• GET /auth/v1/subscriptions/me (authenticated)
• GET /auth/v1/subscriptions (admin or org-scoped)
• POST /auth/v1/subscriptions/checkout (authenticated)
• POST /auth/v1/subscriptions/portal (authenticated)
• POST /auth/v1/subscriptions (admin/webhook)
• PATCH /auth/v1/subscriptions/:id (admin/webhook)
• DELETE /auth/v1/subscriptions/:id (admin)

Org-Aware Access

The plugin supports org-scoped listing and checkout when an organizationId is provided:

• GET /auth/v1/subscriptions?organizationId=org_...
• POST /auth/v1/subscriptions/checkout with body { organizationId: "org_..." }

To enable this, pass getOrgMemberRole (and optionally orgAccessRoles) in the plugin config.

subscriptionsPlugin({
  stripeSecretKey: env.STRIPE_SECRET_KEY,
  stripeWebhookSecret: env.STRIPE_WEBHOOK_SECRET,
  tiers: { ... },
  getOrgMemberRole: async (ctx, organizationId) => {
    // return the member role or null
  },
  orgAccessRoles: ["owner", "admin", "member"],
})

If organizationId is provided and getOrgMemberRole is not configured, the request is forbidden unless the user is a global admin.

Notes

• Global admins (user.role === "admin") can access all subscription records without org membership checks.
• Org access defaults to roles owner, admin, member unless overridden.