github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #5517] Remove or make configurable the hard-coded default limit of 100 members per organization #10273

New Issue
Closed
opened 2026-04-13 06:17:10 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-13 06:17:10 -05:00
Owner
Copy Link

Originally created by @gottfrois on GitHub (Oct 23, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5517

Description

The organization plugin currently has a hard-coded default limit of 100 members per organization in the acceptInvitation function:

2a02166eef/packages/better-auth/src/plugins/organization/routes/crud-invites.ts (L525)

While this limit can be overridden via orgOptions.membershipLimit, the default of 100 is arbitrary and may be too restrictive for many production applications, especially enterprise SaaS platforms that need to support larger organizations.

Problem

  1. Restrictive Default: 100 members is a relatively low limit for many real-world use cases (enterprise teams, large organizations, etc.)
  2. Silent Failure Risk: Developers may not be aware of this default until they encounter the limit in production
  3. Arbitrary Choice: The number 100 appears to be arbitrary without clear justification for why this specific limit was chosen

Proposed Solutions

Option 1: Remove the default limit entirely

const membershipLimit = ctx.context.orgOptions?.membershipLimit;

if (membershipLimit !== undefined && membersCount >= membershipLimit) {
  throw new APIError("FORBIDDEN", {
    message: ORGANIZATION_ERROR_CODES.ORGANIZATION_MEMBERSHIP_LIMIT_REACHED,
  });
}

Option 2: Significantly increase the default

const membershipLimit = ctx.context.orgOptions?.membershipLimit || 10000;

Option 3: Make it explicit in the configuration

Require developers to explicitly set membershipLimit in their organization configuration, with no default value.

Use Case

We're building an enterprise SaaS platform where organizations regularly exceed 100 members. While we can set membershipLimit explicitly, we believe the default should be either much higher or removed entirely to avoid surprising developers with this limitation.

Additional Context

A similar pattern exists for invitationLimit which also defaults to 100. It might be worth reviewing all hard-coded limits in the organization plugin.

Breaking Change Consideration

Changing or removing the default limit could be considered a breaking change if existing users rely on the 100-member limit for their business logic. If that's a concern, this could be introduced as part of a major version bump with clear migration documentation.

Originally created by @gottfrois on GitHub (Oct 23, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5517 ### Description The organization plugin currently has a hard-coded default limit of 100 members per organization in the `acceptInvitation` function: https://github.com/better-auth/better-auth/blob/2a02166eefd714e8d599201b8d979e2f82bc462b/packages/better-auth/src/plugins/organization/routes/crud-invites.ts#L525 While this limit can be overridden via `orgOptions.membershipLimit`, the default of 100 is arbitrary and may be too restrictive for many production applications, especially enterprise SaaS platforms that need to support larger organizations. ### Problem 1. Restrictive Default: 100 members is a relatively low limit for many real-world use cases (enterprise teams, large organizations, etc.) 2. Silent Failure Risk: Developers may not be aware of this default until they encounter the limit in production 3. Arbitrary Choice: The number 100 appears to be arbitrary without clear justification for why this specific limit was chosen ### Proposed Solutions Option 1: Remove the default limit entirely ```typescript const membershipLimit = ctx.context.orgOptions?.membershipLimit; if (membershipLimit !== undefined && membersCount >= membershipLimit) { throw new APIError("FORBIDDEN", { message: ORGANIZATION_ERROR_CODES.ORGANIZATION_MEMBERSHIP_LIMIT_REACHED, }); } ``` Option 2: Significantly increase the default ```typescript const membershipLimit = ctx.context.orgOptions?.membershipLimit || 10000; ``` Option 3: Make it explicit in the configuration Require developers to explicitly set `membershipLimit` in their organization configuration, with no default value. ### Use Case We're building an enterprise SaaS platform where organizations regularly exceed 100 members. While we can set membershipLimit explicitly, we believe the default should be either much higher or removed entirely to avoid surprising developers with this limitation. ### Additional Context A similar pattern exists for invitationLimit which also defaults to 100. It might be worth reviewing all hard-coded limits in the organization plugin. ### Breaking Change Consideration Changing or removing the default limit could be considered a breaking change if existing users rely on the 100-member limit for their business logic. If that's a concern, this could be introduced as part of a major version bump with clear migration documentation.
GiteaMirror added the enhancementlocked labels 2026-04-13 06:17:10 -05:00
GiteaMirror commented 2026-04-13 06:17:14 -05:00
Author
Owner
Copy Link

@jorgedanisc commented on GitHub (Nov 11, 2025):

I would also add that membershipLimit could be similar to organizationLimit where we are capable of using a function that returns a boolean, this is particularly useful for dynamic limits.

similar to this, per the docs:

organizationLimit: number | ((user: User) => Promise | boolean) - The maximum number of organizations allowed for a user. By default, it's 5. You can set it to any number you want or a function that returns a boolean.

<!-- gh-comment-id:3516555757 --> @jorgedanisc commented on GitHub (Nov 11, 2025): I would also add that `membershipLimit ` could be similar to `organizationLimit` where we are capable of using a function that returns a boolean, this is particularly useful for dynamic limits. similar to this, per the docs: >organizationLimit: number | ((user: User) => Promise<boolean> | boolean) - The maximum number of organizations allowed for a user. By default, it's 5. You can set it to any number you want or a function that returns a boolean.
GiteaMirror commented 2026-04-13 06:17:15 -05:00
Author
Owner
Copy Link

@limegorilla commented on GitHub (Dec 2, 2025):

Just run into this myself - the 100 limit does seem arbitrary and personally a function would be the best implementation.

IMO:

  • If not specified, retain the current functionality of 100 to ensure people who rely on it are not impacted
  • Allow either direct values, or an async function that returns either 'unlimited' or a number taking in the org as a prop

This would be a massive QOL improvement - you could have tiered limits based off subscription level for example.

<!-- gh-comment-id:3600785763 --> @limegorilla commented on GitHub (Dec 2, 2025): Just run into this myself - the 100 limit does seem arbitrary and personally a function would be the best implementation. IMO: - If not specified, retain the current functionality of 100 to ensure people who rely on it are not impacted - Allow either direct values, or an async function that returns either `'unlimited'` or a `number` taking in the org as a prop This would be a massive QOL improvement - you could have tiered limits based off subscription level for example.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10273
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?