Recipes

Hono — B2B SaaS (multi-tenant)

2 min read·Updated Jun 19, 2026

← All recipes · First time? Set up your app (60 seconds — keys + redirect URI)

A Hono backend where each customer is a tenant, users may belong to multiple tenants, and roles are scoped per tenant. Builds on the single-tenant Hono recipe — read that first; this page only shows the deltas.

1. What you'll build#

A B2B SaaS Hono API where the user signs in, picks a tenant (Authaz Sign-In handles the picker UI), and every endpoint reads tenant_id from the access token to scope its work.

2. Application setup#

Create the application as multi-tenant, shared pool:

POST https://your-app.authaz.io/api/v1/applications
X-API-Key: mgmt_01h...
 
{
  "name": "my-saas",
  "tenancy_type"

Previous: Hono — first integration
Next: React SPA — first integration

import { Context } from "hono";
import { getAccessToken } from "@authaz/hono";
import { decodeJwt } from "jose";
 
type AuthazClaims = {
  sub: string;
  email?: string;
  tenant_id?: string;
  roles?: string[];
};
 
export function getSession(c: Context): {
  userId: string;
  tenantId: string | null;
  email?: string;
  roles: string[];
} | null {
  const token = getAccessToken(c);
  if (!token) return null;
  const claims = decodeJwt(token) as AuthazClaims;
  return {
    userId: claims.sub,
    tenantId: claims.tenant_id ?? null,
    email: claims.email,
    roles: claims.roles ?? [],
  };
}

app.get("/me", (c) => {
  const s = getSession(c);
  if (!s) return c.json({ error: "unauthorized" }, 401);
  if (!s.tenantId) return c.json({ error: "no_tenant" }, 403);
  return c.json({ userId: s.userId, tenantId: s.tenantId, email: s.email });
});

app.post("/invoices", async (c) => {
  const s = getSession(c);
  if (!s || !s.tenantId) return c.json({ error: "forbidden" }, 403);
 
  const check = await fetch("https://your-app.authaz.io/api/v1/authz/check", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.AUTHAZ_API_KEY!,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      user_id: s.userId,
      permission: "invoices:create",
      tenant_id: s.tenantId,
    }),
  }).then((r) => r.json());
 
  if (!check.allowed) return c.json({ error: "forbidden" }, 403);
 
  // …create the invoice scoped to s.tenantId…
  return c.json({ ok: true, tenantId: s.tenantId });
});

Hono — B2B SaaS (multi-tenant)

1. What you'll build#

2. Application setup#

3. Install#

4. Configure#

5. Wire it up#

6. Read tenant from the token#

7. Tenant-scoped permission check#

8. Common gotchas#

9. Next steps#