My LMS has three areas: super admin, vendor, and client. I need to support a person who may already have a vendor account but later needs access to the client side using the same email address. Better Auth stores users in a single user table where email addresses are unique, so creating a second user record with the same email is not possible. What is the recommended way to model users who need both vendor and client access?
2 Answers
This is best handled with role-based access control. Keep one user record for each real person, then assign multiple roles such as ["vendor", "client"]. The application can check the active role or permissions when deciding which features and screens they can access. You could add a roles field or use Better Auth’s admin features to manage those permissions.
Treat this as a data-modeling issue rather than an authentication limitation. An email should identify one user, while roles or organization memberships describe what that user can do. If vendor and client represent separate workspaces or tenants, Better Auth’s organization or multi-tenant approach is a better fit: one account can belong to multiple organizations, with different permissions in each. Duplicating user rows can create conflicts with password resets, OAuth accounts, and sessions.
So would that mean storing both roles in a field on the Better Auth user record, or should they be kept in a separate role table?