multi-tenant-architecture
Plan a multi-tenant SaaS platform by choosing between Cloudflare Workers and Vercel, then work through tenant identification, isolation, routing, context propagation, and custom domain support. Maps platform limits to pricing tiers and covers domain strategy decisions including PSL submission.
Multi-tenant-architecture guides you through designing isolated SaaS platforms on Cloudflare or Vercel with proper routing and domain strategy.
AI-generated summary based on this skill's SKILL.md
Install
mblode/agent-skills/multi-tenant-architecture · repository language: Shell
git clone https://github.com/mblode/agent-skills
cp -r agent-skills/skills/multi-tenant-architecture ~/.claude/skills/multi-tenant-architecturenpx skillfed install mblode/agent-skills/multi-tenant-architectureFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I build a multi-tenant SaaS app with proper tenant isolation?
multi-tenant-architecture guides you through designing a multi-tenant SaaS platform with robust tenant isolation. Start by choosing your hosting layer—Cloudflare Workers or Vercel—then implement tenant identification via subdomain or custom domain routing. Establish clear isolation boundaries at the database, cache, and file storage layers. Use middleware to extract tenant context from the request and propagate it through your application stack, ensuring data and resources remain segregated per tenant.
What's the difference between Cloudflare and Vercel for multi-tenant hosting?
multi-tenant-architecture compares both platforms for multi-tenant deployments. Cloudflare Workers excel at edge-level tenant routing and request transformation with minimal latency, ideal for high-volume subdomain-based architectures. Vercel offers integrated middleware for tenant identification and works seamlessly with Next.js applications, providing simpler setup for custom domain support and per-tenant static assets like robots.txt and sitemaps. Choose Cloudflare for performance-critical edge routing; choose Vercel for rapid Next.js-based SaaS development.
How do I add custom domains to my multi-tenant app?
multi-tenant-architecture covers custom domain implementation by routing tenant requests through DNS CNAME records pointing to your platform. Generate SSL certificates for each tenant domain—either via wildcard certificates for subdomains or individual certificates for custom domains. Map the incoming domain to your tenant identifier in middleware, then route requests to the correct tenant context. For scale, consider PSL (Public Suffix List) submission to enable proper cookie isolation across tenant domains.
How do I route tenants by subdomain with SSL certificates?
multi-tenant-architecture explains subdomain-based tenant routing by extracting the subdomain from incoming requests in your edge layer or middleware. Use wildcard SSL certificates (*.yourdomain.com) to cover all subdomains with a single certificate. Extract the subdomain in your routing logic, map it to a tenant ID, and propagate that context through your application. This approach scales efficiently and keeps tenant identification simple, though it locks tenants to your primary domain.
How do I map platform limits to pricing tiers in a multi-tenant SaaS?
multi-tenant-architecture connects resource limits to billing plans by defining per-tenant quotas—API rate limits, storage, concurrent users, or feature flags—tied to each pricing tier. Store these limits in your tenant configuration, then enforce them at request time via middleware or application logic. Track usage per tenant and trigger billing events when thresholds are crossed. This approach ensures fair resource allocation and creates natural upgrade incentives as tenants grow.
What are multi-tenant architecture best practices for tenant isolation?
multi-tenant-architecture emphasizes isolation at multiple layers: use separate database schemas or row-level security per tenant, isolate cache keys with tenant prefixes, and segregate file storage by tenant directory. Implement tenant context propagation through middleware so every request carries tenant identity. Avoid cross-tenant data leaks by validating tenant ownership on every query. Test isolation boundaries regularly and use audit logs to track cross-tenant access attempts.
SKILL.md
rendered from the published skill — quoted content, verbatim
Multi-Tenant Platform Architecture (Cloudflare or Vercel)
- IS: domain strategy, tenant identification and isolation, subdomain routing, custom domains, white-label setup, and plan/limit mapping on Cloudflare or Vercel.
- IS NOT: general app folder structure or module boundaries (use
define-architecture), scaffolding a new repo (usescaffold-nextjs), or the content of per-tenant SEO artifacts once routing serves them dynamically: sitemap entries, canonical URLs, structured data, indexing
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 7 files
skills/multi-tenant-architecture/SKILL.md
skills/multi-tenant-architecture/agents/openai.yaml
skills/multi-tenant-architecture/references/cloudflare-platform.md
skills/multi-tenant-architecture/references/limits-and-quotas.md
skills/multi-tenant-architecture/references/psl.md
skills/multi-tenant-architecture/references/vercel-domains.md
skills/multi-tenant-architecture/references/vercel-platform.md