Kinde Organizations

Runs organization lifecycle: create, configure, populate, switch, and suspend Kinde organizations after a tenant contract exists. This skill consumes that contract; it does not invent a second tenancy model.

Stance

Inspect the live Kinde business, environment, application stack, onboarding mode, and authorized control plane before mutating anything. Dashboard clicks, Management API writes, and MCP creates are mutations: without authorization record planned; with authorization apply and capture observed evidence.

Dated sources and first-party conflicts live in REFERENCES.md. Read it before relying on a product claim that is not already recorded in a sibling file, and whenever two official pages disagree.

Guardrails

• Contract first. Actively invoke kinde-b2b and consume its filled tenant contract before organization work. If that skill is unavailable, stop at a blocked contract handoff.
• Default organization. Every business has one. Its org_code cannot be changed and it cannot be suspended (DEFAULT_ORGANIZATION_CANNOT_BE_SUSPENDED). Suite safety policy blocks deleting it. Auto-assign of unknown sign-ups into it can be turned off, and usually should be for B2B.
• MCP inspects. Management MCP may list and get organizations and their users. It does not create, update, or delete organizations or members. Broader mutations use the Management API. Details: LIFECYCLE.md.
• Assignment, not catalog. Assigning roles/permissions to members lives here (ids on direct endpoints, keys on bulk membership). Role/permission definitions belong to kinde-authorization.
• Adapter handoff. Actively invoke the loaded framework adapter for auth-URL and SDK helpers (is_create_org, org_code, org_name, createOrg, switcher login). If no adapter is available, mark implementation blocked. This skill names parameters; it does not emit framework snippets.

Read map