# 060104 Better Auth Rbac

> Role-based access control with Better Auth — permission statements, createAccessControl, authorize() checks, dual auth, and frontend permission sync.

- Skill: `natuleadan/060104-better-auth-rbac` (Agent Skill, multi-file: 8 files)
- Install (CLI): `npx skillmds@latest add natuleadan/060104-better-auth-rbac`
- Raw SKILL.md: https://api.skillmd.com/api/skills/natuleadan/060104-better-auth-rbac/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: MIT
- Author: natuleadan (https://skillmd.com/u/natuleadan)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/natuleadan/060104-better-auth-rbac

---


# Better Auth RBAC

## When to use

When implementing granular role-based permissions beyond Better Auth's built-in admin plugin roles.

## References

| Topic | File |
|---|---|
| Permission statements | `references/permission-statements.md` |
| Role definitions | `references/role-definitions.md` |
| Dual auth (API key + session) | `references/dual-auth.md` |
| Frontend permissions sync | `references/frontend-sync.md` |

## Quick checklist

- [ ] Define all permission actions in `customStatements` with `as const`
- [ ] Create roles with `ac.newRole({})` mapping statements to actions
- [ ] Check permissions with `roleObj.authorize(permissions)`
- [ ] Admin role always passes (short-circuit before authorize)
- [ ] Use `requireApiKeyOrSession()` for dual auth (Bearer or cookie)
- [ ] Frontend: keep `permissions.ts` in sync with backend role definitions