Multi-tenant architecture
Organization switching: letting one user belong to many tenants
How to let one person work across several tenants safely: memberships, choosing the active tenant, scoping tokens per tenant, and avoiding data bleed.
The short answer
Organization switching lets one signed-in person move between tenants they belong to without signing in again. The safe pattern is to authenticate the person once, then issue tenant-scoped tokens or sessions per active tenant, so that every token names exactly one tenant and switching is an explicit exchange rather than a header the client can change.
Sources last reviewed .
Why one token for all tenants is risky
A token that lists every tenant the user belongs to forces every API to choose which one applies, usually from a client-supplied value. One missed check and data from tenant A appears while the user is working in tenant B. A token scoped to one tenant makes the wrong answer impossible rather than unlikely.
The pattern
- Authenticate the person; the result identifies them and lists their eligible memberships.
- The user picks a tenant (or the app restores the last one).
- The app exchanges its identity-level token for a tenant-scoped token — RFC 8693 token exchange is a standard way to do this.
- Switching repeats the exchange for another tenant. Cached data from the previous tenant is discarded client-side.
Policy differences between tenants
If tenant B requires MFA and tenant A does not, switching to B must be able to require step-up. RFC 9470 defines how an API can signal that a token's authentication is insufficient, so the client re-authenticates with stronger assurance.
In Authreads
How this applies to Authreads
In Authreads, sign-in returns identity plus eligible memberships, and the relying party selects a workspace by performing an RFC 8693 token exchange.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.