Tenants and environments

A tenant is your account and billing entity. Everything you create belongs to exactly one tenant, and no other tenant can read it.

Tenant
 ├── Environments: live, test
 ├── Members (staff with roles)
 ├── Organizations (brands, venues, creators)
 │    └── product resources (events, fanbases, products, streams)
 ├── Customers (your end users)
 └── API keys, webhook endpoints, integrations, domains

Environments

Each tenant has a live and a test environment. Every object carries livemode: true for live and false for test. The two never mix, and the key you use decides which one you are in.

Test mode routes payments to a simulator, captures messages and uses test media. See test mode.

How a request finds its tenant

Vabu OS checks these in order and uses the first match.

1. A secret or restricted key in Authorization: Bearer .... It carries the tenant, environment and scopes.
2. A publishable key in Vabu-Publishable-Key, or the key query parameter on public embeds.
3. A user access token. The tenant comes from the token's tid claim. If a staff member belongs to several tenants, send Vabu-Tenant to choose one.
4. A custom domain, for whitelabel pages.
5. The legacy X-Tenant-Code header, kept for existing tenant apps until they move to publishable keys.

Isolation

Tenant isolation is enforced in the application and again in the database, and every new endpoint is tested to prove one tenant's key cannot read or write another tenant's data. You do not need to add tenant filters to your own calls.

Organizations and customers

An organization is a brand, venue or creator inside your tenant. Product resources such as events and streams belong to an organization.

A customer is one of your end users. Whether a person arrived through Vabu ID, your own tokens or a server call, they are a customer in your tenant. You can attach your own ID with external_id.

Members

Members are your staff. Membership is explicit: being signed in does not make anyone a member. Roles control what a member can do in the console and API.