Dashboard

The Dashboard plugin is the core connection between your Better Auth instance and Better Auth Infrastructure. It powers the web dashboard with real-time data, tracks user activity, and enables admin APIs.

What the Dashboard Plugin Enables

Once dash() is active, the Better Auth Infrastructure dashboard gives you:

• User management — view, search, ban, and delete users
• Session monitoring — see active sessions and revoke them
• Organization overview — manage organizations and members
• Analytics — track sign-ups, sign-ins, and active users over time
• Audit logs — query event history (learn more)

Installation

import { betterAuth } from "better-auth";
import { dash } from "@better-auth/infra";

export const auth = betterAuth({
  plugins: [
    dash(),
  ],
});

Configuration Options

DashOptions

Activity Tracking

Track when users were last active in your application. When enabled, a lastActiveAt field is automatically updated on user activity.

dash({
  apiKey: process.env.BETTER_AUTH_API_KEY,
  activityTracking: {
    enabled: true,
    updateInterval: 300000,  // Update interval in ms (default: 5 minutes)
  },
}),

Schema Changes

When activity tracking is enabled, the plugin adds a field to your user schema:

user: {
  fields: {
    lastActiveAt: {
      type: "date",
    },
  },
}

npx auth migrate

If your app manages schema generation separately, run npx auth generate and apply the generated migration with your preferred tool.

Managed Directory Sync

The managedDirectorySync option is the dashboard-side companion to the SCIM 1.7 plugin-managed runtime flow. When enabled is true, the dashboard installs the reservation tables and APIs needed for managed directory-sync state. ssoPairing enables the SSO hooks needed when a directory-backed user identity is paired with an SSO provider, and membershipProjection lets the system project SCIM membership changes into organization membership records.

dash({
  apiKey: process.env.BETTER_AUTH_API_KEY,
  managedDirectorySync: {
    enabled: true,
    ssoPairing: true,
    membershipProjection: {
      enabled: true,
      role: "member",
    },
  },
})

This opt-in control plane is for the SCIM 1.7 plugin-managed runtime flow. In Better Auth 1.7, SCIM supports three connection modes:

• static code-defined connections
• application-owned runtime verification
• plugin-managed runtime connections via managedConnections

The managedDirectorySync option enables the plugin-managed mode for directory-sync provisioning in dash. It creates the reserved schema and APIs needed to manage directory connections and paired SSO state.

Managed directory sync options

Use this when the application wants Better Auth to manage the runtime tenant connection lifecycle for SCIM and pair it with SSO-based identity resolution. It is intended for the new 1.7 flow and complements scim({ managedConnections }).

npx auth migrate

If your app manages schema generation separately, run npx auth generate and apply the generated migration with your preferred tool.

Database Schema

When managedDirectorySync.enabled is true, the dash plugin adds the following models. Better Auth supplies the primary id field for each model.

directorySyncConnection

Stores the managed directory's organization, SCIM connection, SSO pairing, lifecycle, and decommission state.

directorySyncMembershipProvenance

Tracks organization memberships created or managed by directory-sync projection so the plugin can reconcile only the memberships it owns.

For the full SCIM model and migration guidance, see the SCIM plugin reference and the 1.7 upgrade guide.

Event Tracking

The dash plugin automatically tracks the following events:

User Events

Session Events

Account Events

Verification Events

Organization Events

If you're using the organization plugin, these events are also tracked:

Dashboard Endpoints

The dash plugin registers numerous admin endpoints for the dashboard:

User Management

Session Management

Organization Management

Team Management

Invitation Management

SSO Management

Directory Sync

Log Drains

Events & Audit Logs

Analytics

Two-Factor Management

Client Integration

dashClient()

The client plugin provides access to audit log queries:

import { createAuthClient } from "better-auth/client";
import { dashClient } from "@better-auth/infra/client";

export const authClient = createAuthClient({
  plugins: [dashClient()],
});

Note: For Expo or React Native, import dashClient from @better-auth/infra/native (same API) and pair it with sentinelNativeClient as described in Sentinel — Expo and React Native.

Configuration

dashClient({
  resolveUserId: ({ userId, user, session }) => {
    return userId || user?.id || session?.user?.id;
  },
}),

Get the current user's audit logs

Returns audit events for the current user, or organization-scoped events when you pass organizationId as a member.

Basic query

const session = await authClient.getSession();

const logs = await authClient.dash.getAuditLogs({
  session: session.data,
  limit: 50,
  offset: 0,
});

// Access the data
console.log(logs.data?.events);  // Array of audit log events
console.log(logs.data?.total);   // Total count
console.log(logs.data?.limit);   // Page size
console.log(logs.data?.offset);  // Current offset

See Get current user's audit logs for more information.

Get all audit logs

Returns all audit events for organizations the current user has admin or owner access to. Requires the organization plugin for role checks.

Basic query

const session = await authClient.getSession();

const activity = await authClient.dash.getAllAuditLogs({
  session: session.data,
  limit: 50,
  offset: 0,
});

console.log(activity.data?.events);
console.log(activity.data?.total);

See Get all audit logs for more information.

Best Practices

1. Always set an API key — without it, the plugin cannot communicate with the infrastructure API.

2. Use activity tracking wisely — the update interval affects database writes. For high-traffic apps, consider a longer interval.

3. Monitor audit log retention — different plans have different retention periods. Check your plan limits.

4. Secure your endpoints — dashboard endpoints require authentication. Make sure your dashboard users have appropriate permissions.