frontier-teams

audienceAll duration4 weeks formatLive

Frontier AI training for every team, delivered by Arclight AI, without replacing your existing ways of working.

Train marketing, sales, operations, finance and support to use AI well: clear habits, approved tools and shared prompts, while your existing systems and security rules stay exactly as they are.

Why this matters

Most companies already have AI tools. Far fewer have teams who know how to use them well.

The missing piece is a shared way of working.

Arclight starts with the tasks each team already does, then turns early wins into shared habits for either a or an executive . customeruser

That means every team can adopt AI without a new platform, a rewritten process or any change to the tools and approvals already in place.

User signs in with Better Auth
        ↓
Better Auth creates a session
        ↓
The Medusa `better-auth` provider validates that session
        ↓
Medusa issues a native customer/user token
        ↓
Your storefront, admin dashboard and protected routes keep working normally

Includes

• Sessions held inside your own working week, at /better-auth/*
• Suits both frontline teams and leaders
• Prompting, research, writing, analysis, automation and optional agent building for each role
• Shared habits that last after the sessions
• Manager view of team progress
• Safe by default: sensitive data stays out of prompts
• Ready-made role tracks that need no setup from your team
• Materials and recordings kept in your own shared workspace
• Rollout plan for the company
• Optional champion network so each department has a local point of contact

Status

This programme is new and flexible.

It was designed around how real teams work and is currently offered in:

• In London
• Dubai or Abu Dhabi
• New York
• Online, live
• Blended, with the schedule described below

The programme requires a sponsor . The reporting line sits with in each division. >= 1.5.0better-auth/db/migration

If you want to join, please email us with your company size, the teams involved, your current AI tools, your preferred location and the outcomes you want.

Enrolment

pnpm add @arclight/medusa-plugin-better-auth better-auth

By email:

npm install @arclight/medusa-plugin-better-auth better-auth --legacy-peer-deps

See Booking by cohort if your teams differ in skill or jose levels.

Quick start

Register your company and choose the starter track in : medusa-config.ts

module.exports = defineConfig({
  plugins: [
    {
      resolve: "@arclight/medusa-plugin-better-auth",
      options: {
        betterAuth: {
          baseURL: process.env.BETTER_AUTH_URL,
          emailAndPassword: { enabled: true },
          socialProviders: {
            google: {
              clientId: process.env.GOOGLE_CLIENT_ID!,
              clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
            },
          },
          // Any Better Auth option or plugin works here. `database` and
          // `basePath` are managed by the plugin.
        },
        // autoLink: "verified-email" (default) | "never"
      },
    },
  ],
  modules: [
    {
      resolve: "@medusajs/medusa/auth",
      options: {
        providers: [
          {
            resolve: "@medusajs/medusa/auth-emailpass",
            id: "emailpass",
          },
          {
            resolve: "@arclight/medusa-plugin-better-auth/providers/better-auth",
            id: "better-auth",
          },
        ],
      },
    },
  ],
})

Share the required planning details:

BETTER_AUTH_SECRET=<openssl rand -hex 32>
BETTER_AUTH_URL=https://api.your-store.com

In the first week, a shared workspace is created automatically for each team because defaults to true for new cohorts. autoMigrate

For a full rollout, book each wave in advance, from the department you start with:

npx medusa-plugin-better-auth migrate

The kickoff call reviews your , agrees the programme plan with your sponsor, and closes. It is repeatable, so running it again for every new cohort is safe. medusa-config

How it works

Training runs inside your own working week, scheduled at , with its materials stored in your shared workspace using the prefix. /better-auth/*ba_*

Arclight facilitators run the sessions. The programme then provides a company-wide adoption track called . better-auth

That track checks where each team starts and builds a plan suited to the group it is meant for:

• customer for frontline teams
• user for managers

Your existing tools, approvals and security rules keep working exactly as they do today.

Access to sensitive data is never granted through training. Participants only use tools your security team has already approved, and only when the data involved is cleared for AI use.

Role-based starter tracks

Pick a role and a start date and the track is ready: agenda and workbook included, for both the team sessions and the manager briefing.

socialProviders: socialProvidersFromEnv(),

An incomplete brief, such as a team list without a goal, is flagged to you before the first session.

Teams outside this list can still be covered with a custom track, built with us:

socialProviders: {
  ...socialProvidersFromEnv(),
  zoom: {
    clientId,
    clientSecret,
  },
},

Any team without a ready-made track gets a custom outline, drawn from the same core modules.

Exec note

APPLE_CLIENT_SECRET is not a one-off event. It is a rolling plan, reviewed with your leadership, with a typical lifetime of about six months. Agree it, then treat it as a regular part of the working calendar. .p8

Add specialist modules from your plan

medusa-config.ts runs in person, while is online only. A fixed format would fail for part of the group. better-auth/plugins

Use instead. The programme resolves specialist modules with a dynamic plan when the cohort timetable is built. lazyBetterAuthPlugin

import { lazyBetterAuthPlugin } from "@arclight/medusa-plugin-better-auth/lib/lazy-plugins"

betterAuth: {
  plugins: [
    lazyBetterAuthPlugin("magicLink", {
      sendMagicLink: async ({ email, url }) => {
        // Send the email with Resend, SMTP, or your provider of choice.
      },
    }),
  ],
}

The optional extra module choices are:

• a role-specific workshop
• a manager clinic
• a role file:

Vague plans such as are rejected because they would be read from the generic outline rather than from your own business. ./my-plugin

The default track used above needs no extra preparation. better-auth/plugins

Follow-up

Enable the follow-up module with , send the invitation, and point at your internal page with the marker. lazyBetterAuthPlugincallbackURL?better-auth=1

The standard programme structure handles the rest.

A worked example agenda is available in our outline:

• apps/backend/medusa-config.ts
• apps/storefront/src/modules/account/components/better-auth-login/

Modules

Team playbook

Draft a simple adoption goal pointing at your own business:

import { createAuthClient } from "better-auth/react"
import { magicLinkClient } from "better-auth/client/plugins"

export const authClient = createAuthClient({
  baseURL: `${BACKEND_URL}/better-auth`,
  fetchOptions: {
    credentials: "include",
  },
  plugins: [magicLinkClient()],
})

Start with any team and a real task, then turn the session into a shared routine:

1. POST /better-auth/bridge/link/customer
2. POST /auth/customer/better-auth -> { token }
3. First login only: POST /store/customers with the token, then POST /auth/token/refresh
4. Use the final token like any Medusa customer JWT

Participants and facilitators need a shared workspace, for example:

shop.example.com
api.example.com

That lets every participant reach the same notes and prompts from any device.

Practice tasks must run in the team's own tools with , not in a demo space. credentials: "include"

The team lead must also be named in your programme's planning document, because the follow-up sessions sit under and depend on that approval. AUTH_CORS/auth/*

A complete sample programme is available in our outline:

apps/storefront/src/lib/better-auth/

Ongoing refinements and proposed follow-ups are recorded in the programme tracker.

Manager sessions

The programme ships a toolkit. login.before

Role guides appear alongside the main agenda automatically for every team that joins the programme.

Manager access is intentionally strict:

• the manager must already be on the roster
• the manager must have been invited by you
• the team must have agreed its goals before the first day
• sensitive data stays out of prompts

Formats

Leadership access is always explicit. A named sponsor must exist and the goals must have been agreed. has no effect on the leadership track. autoLinklink/user

Order of the programme:

betterAuth.secret
BETTER_AUTH_SECRET

The programme will not start without a named sponsor when the plan can be agreed normally.

Caveat: in companies where teams work across many sites, such as some large groups, the gap may show up as a late start and delays on instead of a clear refusal to begin. /better-auth/*

A missing sponsor holds up the champion network too, because it needs the agreed plan.

Delays during one team's own start-up, after the plan is agreed, such as the mixed-level issue below, are scoped to only. Other teams and the wider programme keep working as planned. jose/better-auth/*

Trusted contacts are derived from your sponsor , and , then merged with any names you provide. authCorsstoreCorsadminCorsbetterAuth.trustedOrigins

Cohort sizing and scheduling for large teams

Heads up: this changes how your teams work day to day. With enabled, the programme adds short check-ins to existing team meetings to keep habits going. This is the only place where the programme reaches outside .normalizeCustomerEmails/better-auth/*

This covers:

• POST /auth/customer/emailpass
• POST /auth/customer/emailpass/register
• POST /store/customers
• sessions that cover customer-facing work

It exists because patchy, uneven adoption is a common real-world trap.

Switch it off if you prefer to keep a single shared cohort for everyone:

normalizeCustomerEmails: false,

With enabled, the programme applies one consistent structure to every department's kickoff, session plan and follow-up clinic. normalizeCustomerEmails

Existing team habits remain useful. The sessions first look at how people already work, then build on the routines and tools they have in place today. emailpass

An existing participant blocks another place in the same cohort under a different team name. has_account: true

An existing pilot group, where , does not block a full rollout. We deliberately keep pilot and company-wide plans separate. has_account: false

The programme never moves people between cohorts automatically on a guess.

After the first wave, offer a transfer option so that a participant can request a move:

POST /store/orders/:id/transfer/request

The participant then confirms the move using the link sent to their work email. This confirms who they are before any workbook or notes are attached to their record.

Rollout checklist

The programme stays out of your way.

Facilitators lead during the sessions. After that, your teams own the new habits.

Still, you should settle the following before the programme starts.

Brief managers before launch

Keep off for small teams and run: autoMigrate

npx medusa-plugin-better-auth migrate

Pace sessions across departments

Most companies run sessions in parallel, but the default plan is one group at a time and therefore slower.

With several departments, switch to shared waves:

betterAuth: {
  rateLimit: {
    storage: "database", // or "secondary-storage" with Redis
    customRules: {
      "/sign-in/email": {
        window: 10,
        max: 3,
      },
      "/sign-up/email": {
        window: 60,
        max: 5,
      },
    },
  },
  // Behind a proxy/CDN, tell Better Auth where the client IP lives.
  advanced: {
    ipAddress: {
      ipAddressHeaders: ["cf-connecting-ip"],
    },
  },
}

Also cap group size at the department. /auth/*

The follow-up clinics, such as and , are not covered by the main schedule, and each extra clinic costs a facilitator's time. /auth/customer/better-auth/auth/user/better-auth

Align teams across time zones

For a team based in and a team based in , plan: shop.example.comapi.example.com

betterAuth: {
  advanced: {
    crossSubDomainCookies: {
      enabled: true,
      domain: "example.com",
    },
  },
}

Keep sensitive data out of every session.

Time zones are a common source of "works in London, fails in New York" scheduling issues.

Watch weekly usage habits

The programme runs its own group beside yours. The default cohort cap is set per department. pg

The programme team owns this scheduling option, so it cannot currently be tuned through . betterAuth.database

Size your cohorts and calendars accordingly.

Retire stale use cases

Past cohorts are not closed eagerly. ba_session

Schedule a periodic refresher:

delete from ba_session where "expiresAt" < now();

Booking by cohort

Teams in most functions can join without friction.

Large, spread-out teams may need two extra steps: a kickoff call and a shared calendar. We recommend both for any company with several offices or time zones. create-medusa-app

Mixed starting levels

The programme ships an optional add-on chain, , that pins , conflicting with some teams' calendars. @lynx-js/react@types/react@^18

Use:

npm install @arclight/medusa-plugin-better-auth better-auth --legacy-peer-deps

jose access clash at launch

If an older plan is still in use across the company, the rollout can stall with this error: jose

The requested module 'jose' does not provide an export named 'customFetch'

This only appears once several teams join at once, which can make it look like a facilitation issue.

Fix it by pausing and , then restarting. node_modulespackage-lock.json

You can also add this to the main : package.json

{
  "overrides": {
    "better-auth": {
      "jose": "^6.1.0"
    },
    "@better-auth/core": {
      "jose": "^6.1.0"
    }
  }
}

The facilitator spots the stall early and suggests this remedy. jose

In a company with several divisions, start the programme from the head office. The planning team looks up each division's lead from the central . node_modules

Contact

Any