# Multi-tenant Next app, which tokenScope keeps one tenant's identity out of another?

Asked by lucy.k on 2026-10-18. Tags: nextjs, identity, tokenscope.

We build a multi-tenant SaaS where a single browser can switch between tenant
workspaces in the same session. My concern is identity bleed: I do not want a
token or identity resolved under tenant A to carry over when the same person
lands in tenant B.

Which `tokenScope` setting fits this? I see global, isolated and contextual but
I want to pick the one that actually prevents the cross-tenant leak.

## 2 answers

### Answer from Priya Raghavan (2026-10-19)

`tokenScope` controls how tokens are shared across contexts, and for your
case you want to move off `global`, which is the one that would share a single
token everywhere and cause exactly the bleed you are describing. Both
`isolated` and `contextual` keep one context's token from leaking into
another in the same browser, so either prevents the cross-tenant leak, the
question is which model matches how you define a context. fwiw identity is
keyed off the client ID and user token, so scoping the token is the lever that
controls the bleed.

### Answer from Devon Lane (2026-10-21)

worth adding, weigh isolated vs contextual by how tenants map to your URLs. if
each tenant is a clean separate context, contextual keeps a distinct token per
context automatically, which reads closer to your tenant boundary. isolated is
the blunter separation. one config reminder while you are wiring it, the
`token` and `userId` init options are mutually exclusive, do not set both.
there is a longer discussion of the scopes in
[the multiple accounts and tabs thread](/answers/tokenscope-multiple-accounts-tabs)

#### Reply from lucy.k (2026-10-22)

that narrows it down, our tenants map cleanly to separate contexts so
contextual looks like the fit. going to prototype both and confirm the
token does not carry across. thanks