Docs / Reference / Glossary
Glossary
Terms that show up throughout Keel's codebase and docs, in the sense they're actually used here, not the generic SaaS-blog definition.
Multi-tenancy
Every row that belongs to a customer is scoped to a team, not a user. A user can belong to more than one team, and every team-scoped query filters by teamId first. This is what lets one Keel deployment serve many customers without leaking data between them.
RBAC (role-based access control)
Three per-team roles (owner, admin, member) plus one global superadmin role that sits outside any team. See Permissions for the full breakdown and the can()/outranks() helpers.
Entitlements
What a team is allowed to do, derived from its active plan, not from its role. A member and an owner on the Starter plan are both blocked from admin-panel features, roles gate actions within a team, entitlements gate features across plans.
Credit ledger
The running balance of AI usage credits for a team, stored as an append-only sequence of debits and credits rather than a single mutable counter. An append-only ledger means a failed request never corrupts the balance, and every deduction is auditable after the fact.
Webhook de-dupe
Stripe (and other providers) can deliver the same webhook event more than once. Keel records each processed event ID before acting on it, so a re-delivered checkout.session.completed doesn't grant a second team's worth of access or double-charge credits.
Why this matters more than it sounds
Payment webhooks are the one place where "ran twice" and "granted double the plan" are the same bug. De-dupe isn't an edge case here, it's the default assumption.
Magic link
A one-time sign-in link emailed to a user instead of a password. Better Auth issues and verifies these; no password hash is ever stored for accounts that only ever use magic links.
DAL (data access layer)
Server-only functions under lib/dal/*.ts that every API route calls into instead of querying the database directly. authorizeTeamAccess(teamId, permission) is the DAL function every team-scoped route calls first.
Audit log
An append-only record of who did what to which team, kept separate from the data being changed so that log entries survive even if the underlying record is later deleted.
API key scope
Each generated API key is tied to a single team and a fixed set of permissions, not the permissions of whichever user created it. Revoking a user's access doesn't silently change what a key they generated is still allowed to do.