Multi-tenant platforms

Bind an external customer tenant to one BlendDuck organization safely.

Documentation owner:
BlendDuck Documentation
Last reviewed:

Status: tested reference flow available.

One external customer tenant maps to one BlendDuck organization and one encrypted organization API key. Browser code never receives the stored bearer value.

Connection sequence

  1. The platform backend creates a signed, short-lived, single-use connect state for its authenticated tenant and an allowlisted HTTPS return URL.
  2. The user signs in to BlendDuck and connects social accounts to the intended organization.
  3. The organization owner transfers the one-time API key to the platform's authenticated backend form—never a URL.
  4. The backend calls GET /api/v1/tenant, verifies the expected organization, and stores the external-tenant mapping with the encrypted key.
  5. Later resource calls use /api/v1/channels, /api/v1/posts, and other canonical paths. The key itself selects the organization.

The observe profile uses workspace:read, channels:read, posts:read, media:read, and providers:read. The publish profile adds posts:write and media:write. The workspace-named scope is retained only for compatibility.

Redirect and webhook boundaries

Return state is HMAC-signed, constant-time verified, exactly allowlisted, short-lived, and consumed once. It contains no API key.

The event router accepts only a verified envelope, resolves the external tenant from organizationId, and deduplicates by organization plus stable event ID.

pnpm verify:multi-tenant-platform