Tenant isolation

Partition data by your own customer or tenant on writes, search, and query.

Overview

When you serve many customers, keep each customer's data apart. Graphon gives you two models: a key prefix per tenant, or a bucket per tenant. In both models, your backend holds one API key and decides which tenant a request can touch. To give a tenant direct access to one object, your backend hands out a presigned URL.

Option 1: a key prefix per tenant

Put every tenant's objects under a shared prefix, for example tenants/<tenantId>/. List and read by that prefix. This is simple and keeps one bucket.

Write

graphon objects put support-tickets \
  tenants/acme/incidents/checkout-timeout.json --file ./checkout-timeout.json

List

graphon objects list support-tickets --prefix tenants/acme/

Option 2: a bucket per tenant

For stronger isolation, give each tenant its own bucket. Each tenant then has its own usage, settings, and delete. Your backend creates the bucket when a tenant signs up.

CLI

graphon buckets create tenant-acme --provider gcp --location us-central1

Keep the key in your backend

An API key covers every bucket in its workspace. Never give a tenant your key. Your backend checks which tenant is signed in, then calls Graphon with its own key.

Give a tenant direct access to an object

To let a tenant's browser upload or download a file, your backend asks for a presigned URL and gives the URL to the tenant. The URL works for one request on one object, for 15 minutes. It cannot reach another object or another tenant's bucket.

Presign

curl --request POST \
  --url "https://storage.beta.graphon.sh/v1/workspaces/$GRAPHON_WORKSPACE_ID/buckets/<acmeBucketId>/presign" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"operation": "GetObject", "key": "incidents/checkout-timeout.json"}'

Choose one model early

Moving objects between prefixes or buckets later is extra work. Decide the tenant boundary before you write production data.

Good practices

Put the tenant id in the key prefix or the bucket name, so listing is cheap.
Keep the API key in your backend. Give tenants presigned URLs, not keys.
Never mix two tenants under the same prefix.