Multi-tenant Architecture

Build multi-tenant applications on AmDital's platform.

Tenant Model

Every resource in AmDital belongs to a workspace. The workspace slug or UUID is used as the tenant identifier across all API calls.

// Every API call is scoped to a workspace
GET ${API_URL}/api/tasks?workspace=<workspace-slug>
POST ${API_URL}/api/invoices
{
  "workspace": "<workspace-id>",
  "amount": 1000
}

Data Isolation

AmDital enforces tenant isolation at three layers:

Supabase Row-Level Security per workspace_id
Payload CMS access control via header-derived x-workspace-id
Application-layer workspace membership verification

Membership & Roles

Workspace members have roles (owner, admin, member) stored in workspace_members. The JWT carries the workspace role claim for server-side enforcement.