Multi-tenant architecture
B2B login flows: invitations, domains, SSO and the first admin
The sign-up and sign-in flows a B2B product needs: tenant creation, invitations, domain capture, SSO enforcement, and removing access when people leave.
The short answer
A B2B product needs more than sign-up and sign-in: someone creates the tenant and becomes its first administrator, colleagues join by invitation or verified domain, larger customers later switch to their own SSO, and access must end when people leave. Designing these as one lifecycle — create, join, authenticate, change role, leave — avoids bolting each one on separately.
Sources last reviewed .
The lifecycle
- Create: the first user creates the tenant and holds the administrator role. Require a verified email before granting it.
- Join: by invitation link (single-use, expiring, bound to the invited email) or by verified domain with administrator approval.
- Authenticate: tenant policy decides which methods are allowed.
- Change: role changes take effect at the next request, not the next login.
- Leave: removing a membership ends that membership's sessions and tokens.
Invitation security
An invitation link is a credential. Make it single-use, short-lived, bound to the invited address, and require the recipient to authenticate as that address. Never let an invitation silently attach an existing account belonging to a different email.
When SSO arrives
When a customer turns on SSO, existing users with local passwords must be migrated — usually linked by verified email on their first SSO sign-in — and local passwords disabled for that tenant, with a documented break-glass administrator.
In Authreads
How this applies to Authreads
Hosted login, per-tenant policy, session revocation and the management API for tenant and user management are Available. SAML and SCIM are Planned.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Multi-tenant architecture
Per-tenant SSO: routing each customer to their own identity provider
Protocols and how-tos
SAML SSO for B2B SaaS: what enterprise customers will ask for
Multi-tenant architecture
Organization switching: letting one user belong to many tenants
Glossary: Hosted login · Single sign-on (SSO) · Session revocation · Multi-tenancy
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.