Next.js — B2B SaaS (multi-tenant)

3 min read·Updated May 7, 2026

← All recipes · First time? Set up your app (60 seconds — keys + redirect URI)

A Next.js app where each customer is a tenant, users may belong to multiple tenants, and roles are scoped per tenant. Builds on the single-tenant recipe — read that first; this page only shows the deltas.

1. What you'll build#

A Next.js B2B SaaS app where the user signs in, picks a tenant (Authaz Sign-In handles this UI), and your /dashboard reads tenant_id from the access token to scope every query.

2. Application setup#

Create the app as multi-tenant, shared pool:

POST https://your-app.authaz.io/api/v1/applications
X-API-Key: mgmt_01h...
Content-Type: application/json

Previous: Next.js — first integration
Next: Hono — first integration

AUTHAZ_CLIENT_ID=app_01h...
AUTHAZ_CLIENT_SECRET=secret_...
AUTHAZ_ORGANIZATION_ID=0199...
AUTHAZ_API_KEY=mgmt_01h...

import { getAccessToken } from "@authaz/next";
import { decodeJwt } from "jose";
 
type AuthazClaims = {
  sub: string;
  email?: string;
  tenant_id?: string;
  roles?: string[];
};
 
export async function getSession() {
  const token = await getAccessToken();
  if (!token) return null;
  const claims = decodeJwt(token) as AuthazClaims;
  return {
    userId: claims.sub,
    email: claims.email,
    tenantId: claims.tenant_id ?? null,
    roles: claims.roles ?? [],
    accessToken: token,
  };
}

import { redirect } from "next/navigation";
import { getSession } from "@/lib/session";
 
export default async function Dashboard() {
  const s = await getSession();
  if (!s) redirect("/api/auth/login");
  if (!s.tenantId) {
    return <p>Sign in again to pick a tenant.</p>;
  }
  return (
    <main>
      <h1>Hello, {s.email}</h1>
      <p>Tenant: <code>{s.tenantId}</code></p>
    </main>
  );
}

// app/api/invoices/route.ts
import { withAuth, getAccessToken } from "@authaz/next";
import { decodeJwt } from "jose";
 
export const POST = withAuth(async (req) => {
  const claims = decodeJwt(await getAccessToken() as string) as {
    sub: string; tenant_id?: string;
  };
  if (!claims.tenant_id) {
    return Response.json({ error: "no_tenant" }, { status: 403 });
  }
 
  const check = await fetch("https://your-app.authaz.io/api/v1/authz/check", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.AUTHAZ_API_KEY!,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      user_id: claims.sub,
      permission: "invoices:create",
      tenant_id: claims.tenant_id,
    }),
  }).then(r => r.json());
 
  if (!check.allowed) return Response.json({ error: "forbidden" }, { status: 403 });
 
  // …create the invoice scoped to claims.tenant_id…
  return Response.json({ ok: true });
});

Next.js — B2B SaaS (multi-tenant)

1. What you'll build#

2. Application setup#

3. Install#

4. Configure#

5. Wire it up#

6. Read the user and tenant#

7. Tenant-scoped permission check#

8. Common gotchas#

9. Next steps#