---
title: "Organization members and invitations"
description: "Manage the active Better Auth organization member directory and pending email invitations from the StackShip dashboard."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.stackship.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization members and invitations

The live organization administration surface is **Organization** in the
StackShip dashboard, at `/settings/organization`. It reads the active
organization, its member directory, and its invitations from the Better Auth
organization plugin.

## What is available

Every organization member with a valid dashboard session can read the directory
for their active organization. The page shows:

- the organization name and slug;
- the signed-in member's organization role;
- up to the first 100 members returned by Better Auth; and
- invitation status, assigned role, and expiry.

An observed `owner` or `admin` membership also enables these actions:

- invite an email address as a `member` or `admin`;
- change a non-owner, non-current member between `member` and `admin`;
- remove a non-owner, non-current member; and
- cancel a pending invitation.

Role changes and removals both use the same inline arm-and-confirm pattern:
the first activation arms the control and moves focus to the confirmation,
and only the explicit second activation sends the mutation. The invite form
notes the grant under the role select — admins manage members, credentials,
and policies. After a successful mutation the page refreshes its server data
in place rather than reloading the browser page.

StackShip does not expose ownership transfer or owner removal in this page.
Owner records are intentionally read-only. It also does not expose custom roles,
teams, or grant administration in the current product.

## Authorization and tenant boundary

The dashboard reads the active directory server-side. It rewrites only the
host-only StackShip dashboard session into the Better Auth session cookie for
the `api.stackship.run` request. It does not forward an arbitrary browser
cookie or authorization header.

The response must contain the signed-in user as a member, and every member and
invitation must belong to the returned organization. If the identity response
is unavailable, malformed, or crosses that tenant boundary, StackShip hides the
directory and every mutation control.

The `owner` or `admin` check in the interface only controls what is displayed.
Every invitation, cancellation, role change, and removal is sent through the
same-origin `/api/auth` boundary and is authorized again by Better Auth. A
hidden control is never the authorization boundary.

## Invitations

Invitations use the Better Auth organization invitation record and expire
according to the server's configured invitation lifetime. StackShip sends the
invitation with its configured Cloudflare transactional email sender. A send
failure is returned to the dashboard and the invitation is not represented as
successful by the interface.

The recipient signs in with the invited email address and accepts the
time-limited invitation. Pending invitations can be canceled by an organization
owner or admin. Resending an existing pending invitation is not available in
the current dashboard.

The invitations panel lists pending invitations first; accepted, canceled,
rejected, and expired invitations are collapsed behind a settled-invitations
disclosure so the list stays actionable. Expiry timestamps render in pinned
UTC.

## SSO and SCIM

Better Auth enterprise SSO and SCIM support are part of StackShip's identity
runtime, but connection provisioning and SCIM token administration are not
available in this member-directory page. Do not infer SSO enforcement or SCIM
provisioning status from the presence of a member.

Source: https://docs.stackship.run/admin/organization-directory/index.mdx