Use case · Internal
Operator consoles behind SSO, on the same contracts.
Admin panels, support inboxes, audit tools. Same Better Auth, same RBAC, same audit trail as the customer-facing app. The four sub-systems an internal tool needs are wired into the registry before your first commit.
What's in the box
The four sub-systems every internal tool needs.
Eleven capabilities grouped by the buyer-side question they answer. Pick a cluster, read what you actually get.
Auth & RBAC
Operator identity sits behind the same wall as customer identity, with role-based gating.
SSO from your existing provider
Better Auth wires the operator console against the same user table your customer app uses. No separate password store to provision, no separate rotation cycle.
Role-based access
Scoped roles per operator: read-only, support, finance, ops. Role gates live on the procedure definition, not in a separate middleware you forget to wire up.
Audit trail by default
Every operator action records the actor, the action, and the target. Buyers in regulated verticals audit this in the first call.
auth-and-rbac
sign-in
email
password
Continue
Operator console
The surface the support team operates from. Same data the customer sees, scoped to the operator's role.
Users table with bulk actions
Searchable user table with role filters and bulk operations (impersonate, suspend, reset). Bulk actions hit the same RPC the customer API does, so the two never drift.
Subscription overrides
Override plans, refund invoices, extend trials — without writing SQL. Every override records the actor and the reason.
Live KPIs
MRR, churn, active users, p95 latency. The numbers come from the same queries the product runs, so they're never a stale export.
operator-console
MRR$11,270+8.2%
Active users1,420+112 / wk
Churn1.4%-0.3 pt
Users5 rows
- Ssarah@acme.ioownernow
- Eeric@acme.ioadmin2m ago
- Ddidier@acme.iomember12m ago
- Llena@acme.ioadmin1h ago
- Aandreas@acme.iomemberyesterday
Support & tickets
The inbox your support team works in. Tied to the product surface, not a separate vendor.
Tickets in product context
Support tickets open from any user detail and carry the full session history. No context-switching to a separate Zendesk tab to find what the customer did.
Shared data, scoped writes
Support can read everything; can write only the fields their role allows. The same typed schema governs both customer and operator actions.
CSAT and time-to-first-response
Per-operator response time and customer rating surface in the same dashboard. The data the support manager needs is on the same screen as the team.
support-and-tickets
preview unavailable
Automation
Background work the operator team sets up once and forgets.
Background jobs
Queues and retries wired against the same contract the rest of the app uses. Failed jobs visible in the same dashboard; retries are typed.
Feature flags
Per-org, per-plan flag targeting with history. A flag turned off for an enterprise account last Tuesday is still queryable today.
Scheduled tasks
Cron-style tasks read the same schema, log to the same trace, fail with the same retry policy.
automation
RequestoRPC
GET
contract: ORG_READ. auth: session
Response...
{
"id": "org_2nK9xR",
"name": "Acme Labs",
"plan": "pro",
"mrr": 1127,
"seats": 8,
"stripe_customer_id": "cus_R8x2Wq"
}Stack
What runs on day one.
Next.js
Better Auth
TanStack
shadcn/ui
Process
How an internal tool ships.
- Step 01
Auth behind the same wall
Better Auth on the admin subdomain. SSO and roles wired against your existing user table.
- Step 02
Operators see what they should
Scoped roles, audit log, and rate limits. The contract that gates your customer app gates your support console too.
- Step 03
No second codebase to maintain
The operator console consumes the same Drizzle schema and the same Better Auth sessions as the customer surface. One type system, one deploy.
Built on this
Four templates, each on its own surface.
Production-ready starter templates, each deployed at its own URL. Used as the reference set for what the registry can ship.
Explore
Related use cases.
Related
SaaS apps
Multi-tenant B2B SaaS with auth, billing, and a working dashboard on day one.
Read more
Related
Open source
Maintainer-friendly starters, MIT-licensed, versioned through the same registry.
Read more
Related
AI products
RAG, chat, and agents wired against the same contracts your app uses.
Read more
Two doors
Use it yourself, or have us ship it for you.
Self-serve gives you the registry and the templates. Engagement gives you the team that built it. Pick the door that fits the timeline.