DhokoAuthaz
DocumentationAPI Reference
  • Get Started

    • Authaz
    • Core Concepts
    • Set up your app
    • Quickstart — cURL
  • Authentication

    • Authentication Settings
    • Signup
    • Invitations
    • Password Authentication
    • Multi-Factor Auth
    • Magic Link
    • OAuth / Social Login
    • Passkey (WebAuthn)
    • SAML SSO
    • Machine-to-Machine (M2M)
    • API Keys
  • Authorization

    • Authorization
    • Resources
    • Policies
    • Roles
    • Access Explorer
  • Tenancy

    • Multi-tenancy
    • Tenancy Customization
  • Brand & Host

    • Branding
    • Custom Domains
    • Communications & Email Templates
  • Operate

    • Users
    • Analytics
    • Audit Logs
    • Application Settings
  • SDK Quickstarts

    • Quickstart — Next.js
    • Quickstart — React SPA
    • Quickstart — Hono
    • Quickstart — .NET (Authaz.Sdk)
  • Recipes

    • Recipes & Cookbook
    • Next.js — first integration
    • Next.js — B2B SaaS (multi-tenant)
    • Hono — first integration
    • Hono — B2B SaaS (multi-tenant)
    • React SPA — first integration
    • React SPA — B2B SaaS (multi-tenant)
    • .NET — first integration
    • .NET — B2B SaaS (multi-tenant)
  • Reference

    • Tokens
    • API Reference
    • Errors & Troubleshooting
  • Documentation

    • How Authaz is Built
  1. Authaz
  2. Docs
  3. Get Started
  4. Core Concepts

Get Started

Core Concepts

3 min read·Updated May 7, 2026

Seven words and you have the whole vocabulary:

organization · application · tenant · user · role · provider · Authaz Sign-In

Organization                   ← your company
└── Application                ← a product you ship
    ├── Providers              ← how users sign in
    ├── Users                  ← who signs in
    ├── Roles                  ← what they can do
    ├── Tenants  (optional)    ← your customers' workspaces
    └── Branding               ← logo, colors, domain

Organization#

Your company. One per Authaz customer. Owns billing, team members, and every application.

You don't pass an organization ID when calling the API — your API key (or JWT) already belongs to one, and Authaz scopes everything automatically.

Application#

A product you ship. Each application is independent: its own users, providers, roles, branding, custom domain, API keys.

curl -X POST https://your-app.authaz.io/api/v1/applications \
  -H "X-API-Key: $AUTHAZ_API_KEY" \
  -H "Content-Type: application/json" \
  -d
Previous
Authaz
Next
Set up your app
'{"name": "Customer Portal", "tenancyType": "multi_tenant"}'

One organization can run several applications. Common split: Customer Portal + Admin Console.

Tenancy#

Your customers' workspaces inside an application. Three models:

Single-tenantOne user pool. Right for B2C and internal tools.
Shared-pool multi-tenantUsers belong to many tenants. Roles scoped per tenant. Right for products with cross-workspace identity.
Isolated-pool multi-tenantEach tenant has a separate user pool. No cross-tenant identity possible. Right for regulated industries.

Pick the model at application-creation time. Full guide: Multi-tenancy.

Providers#

A provider is a way to sign in. Enable any combination per application:

PasswordEmail + password. Optional MFA.
OAuth / SocialGoogle, Microsoft, GitHub, Apple.
Magic LinkPasswordless — code emailed on demand.
PasskeyWebAuthn / FIDO2. Biometrics or security keys.
SAML SSOEnterprise IdPs. SP mode.
Machine-to-MachineOAuth client credentials.
API KeysLong-lived keys for customer integrations.

A user can authenticate with any enabled provider — same identity, multiple methods.

Users#

Someone who signs in. Lives inside one application. Optionally belongs to one or more tenants.

GET   /api/v1/users
GET   /api/v1/users/{id}
POST  /api/v1/users/{id}/suspend
POST  /api/v1/users/{id}/sessions/revoke    # force logout
POST  /api/v1/users/{id}/mfa/reset          # they lost their authenticator

Identity is BYO at the authorization layer — userId in /authorization/check is a free-form string, so you can pass auth0|abc, pk_xxx, or your own internal ID and Authaz respects whatever you wrote earlier.

Roles#

A role is a named bundle of permissions. Composed from reusable policies.

curl -X POST https://your-app.authaz.io/api/v1/authorization/check \
  -H "X-API-Key: $AUTHAZ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_01h...",
    "resource": "invoices",
    "action": "create",
    "tenantId": "tenant_acme"
  }'
{ "allowed": true }

Sub-millisecond. Roles can be global or tenant-scoped — same user can be Admin in tenant A and Viewer in tenant B.

For per-record access ("this user can read this specific document"), skip roles and use a direct grant.

Authaz Sign-In#

The hosted login surface — sign-in, sign-up, MFA, password reset, social sign-in, passkey, SAML. Your app redirects users to it; they authenticate; they come back with an authorization code.

You theme it (logo, colors, copy), host it on your domain (auth.yourapp.com), and pick which providers appear — but you never run it. TLS, CSRF, PKCE, sessions, rate limiting, MFA UI, account recovery: all maintained for you.

The handshake is standard OAuth 2.0 + PKCE. Any OAuth client works.

Next#

  • Multi-tenancy — pick a tenancy model.
  • cURL quickstart — see the OAuth flow end-to-end.
  • Authentication Settings — register redirect URIs and tune token lifetimes.