Multi-tenant Next app, which tokenScope keeps one tenant's identity out of another?
We build a multi-tenant SaaS where a single browser can switch between tenant workspaces in the same session. My concern is identity bleed: I do not want a token or identity resolved under tenant A to carry over when the same person lands in tenant B.
Which tokenScope setting fits this? I see global, isolated and contextual but I want to pick the one that actually prevents the cross-tenant leak.
2 answers
tokenScope controls how tokens are shared across contexts, and for your case you want to move off global, which is the one that would share a single token everywhere and cause exactly the bleed you are describing. Both isolated and contextual keep one context's token from leaking into another in the same browser, so either prevents the cross-tenant leak, the question is which model matches how you define a context. fwiw identity is keyed off the client ID and user token, so scoping the token is the lever that controls the bleed.
worth adding, weigh isolated vs contextual by how tenants map to your URLs. if each tenant is a clean separate context, contextual keeps a distinct token per context automatically, which reads closer to your tenant boundary. isolated is the blunter separation. one config reminder while you are wiring it, the token and userId init options are mutually exclusive, do not set both. there is a longer discussion of the scopes in the multiple accounts and tabs thread
that narrows it down, our tenants map cleanly to separate contexts so contextual looks like the fit. going to prototype both and confirm the token does not carry across. thanks