A tenant is a namespace. It owns clients, resources, scopes, permissions and roles, and keeps them isolated from every other tenant. For the conceptual picture, see Entities.
- Tenant ID — lowercase letters, digits and hyphens, starting with a letter. Immutable.
- Description — a free-text label shown in the admin console.
- Edge binding — an optional
edgedeployment ID. When set, every client and resource created inside the tenant is served through thatedge.
Two tenants can each register a client called web-app with no conflict — client IDs,
resource IDs, scope IDs, permission IDs and role IDs are only unique within a tenant.
Users are the one exception: they are not tenant-scoped. A person has a single identity across the whole platform; what changes per tenant is which roles that identity holds there. See User.