Overview
When we rebuilt LegionEdge Cloud around organizations, every organization got its own identity and access management: members, roles, policies, single sign-on, SCIM, service accounts, keys and the audit log. All of it runs on Better IAM, an open-source TypeScript library we build alongside the platform.
This post explains what Better IAM is, how LegionEdge uses it, and why the same library also sits under our compute and our data rooms.
A library, not a service
Better IAM is an embeddable authentication, identity provisioning and access-management platform. You install it from npm, give it your own database (PostgreSQL, SQLite or libSQL), and it runs inside your application. There is no separate identity service to call over the network and no second copy of your users to keep in sync.
It covers the whole identity surface in one place: passwords, magic links, email and SMS codes, TOTP and passkeys; OAuth and OIDC sign-in, SAML SSO and SCIM; roles, groups and versioned JSON policies; just-in-time access with approval; STS-style temporary credentials; and a tamper-evident audit log kept as a per-tenant hash chain. It’s released under Apache-2.0.
A tenant tree for the platform
LegionEdge is a tree of Better IAM tenants. The root tenant is LegionEdge itself. Each customer organization is a child of the root, and each organization’s projects, used for environments such as production and staging, are children of the organization.
Each organization’s owner, and the administrators they appoint, manage their own branch of that tree. Guests, the people outside an organization who are invited into a data room, are Better IAM principals too, so they sign in the same way and show up in the same audit log.
One decision point for everything
The consoles call Better IAM with the signed-in person’s own credential, so every action is authorized and audited as that person. We wrote about how the IAM console does this in One IAM console, three scopes.
The same holds beyond the IAM dashboard. Better Compute, which places and tracks GPU capacity, and Better Files, which runs Data Rooms, both use Better IAM as their identity provider and policy decision point. A role you grant in your organization means the same thing for an instance as it does for a document, and every decision lands in one audit chain.
Use it in your own app
Better IAM is open source and works with Next.js, NestJS, Nuxt, SvelteKit, React Router, Express, Hono and Fastify. The code, guides and runnable examples are on GitHub.
