Multi-Tenant Plugin

https://www.npmjs.com/package/@payloadcms/plugin-multi-tenant

This plugin sets up multi-tenancy for your application from within your Admin Panel. It does so by adding a tenant field to all specified collections. Your front-end application can then query data by tenant. You must add the Tenants collection so you control what fields are available for each tenant.

Core features

Adds a tenant field to each specified collection
Adds a tenant selector to the admin panel, allowing you to switch between tenants
Filters list view results by selected tenant
Filters relationship fields by selected tenant
Ability to create "global" like collections, 1 doc per tenant
Automatically assign a tenant to new documents
Rejects writes that assign a tenant the user is not a member of

Installation

Install the plugin using any JavaScript package manager like pnpm, npm, or Yarn:

1pnpm add @payloadcms/plugin-multi-tenant

Options

The plugin accepts an object with the following properties:

1type MultiTenantPluginConfig<ConfigTypes = unknown> = {
/**
 * Base path for your application
 *
 * https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath
 *
 * @default undefined
 */
basePath?: string
/**
 * After a tenant is deleted, the plugin will attempt to clean up related documents
 * - removing documents with the tenant ID
 * - removing the tenant from users
 *
 * @default true
 */
cleanupAfterTenantDelete?: boolean
/**
 * Automatically
 */
collections: {
  [key in CollectionSlug]?: {
    /**
     * Override the access result from the collection access control functions
     *
     * The function receives:
     *  - accessResult: the original result from the access control function
     *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', 'unlock', or 'validate'
     *  - ...restOfAccessArgs: the original arguments passed to the access control function
     */
    accessResultOverride?: CollectionAccessResultOverride
    /**
     * Opt out of adding the tenant field and place
     * it manually using the `tenantField` export from the plugin
     *
     * Tenant membership is still enforced on write. See Tenant write enforcement.
     */
    customTenantField?: boolean
    /**
     * Set to `true` if you want the collection to behave as a global
     *
     * @default false
     */
    isGlobal?: boolean
    /**
     * Overrides for the tenant field, will override the entire tenantField configuration
     */
    tenantFieldOverrides?: CollectionTenantFieldConfigOverrides
    /**
     * Set to `false` if you want to manually apply the baseListFilter
     * Set to `false` if you want to manually apply the baseFilter
     *
     * @default true
     */
    useBaseFilter?: boolean
    /**
     * @deprecated Use `useBaseFilter` instead. If both are defined,
     * `useBaseFilter` will take precedence. This property remains only
     * for backward compatibility and may be removed in a future version.
     *
     * Originally, `baseListFilter` was intended to filter only the List View
     * in the admin panel. However, base filtering is often required in other areas
     * such as internal link relationships in the Lexical editor.
     *
     * @default true
     */
    useBaseListFilter?: boolean
    /**
     * Set to `false` if you want to handle collection access manually without the multi-tenant constraints applied
     *
     * @default true
     */
    useTenantAccess?: boolean
  }
}
/**
 * Enables debug mode
 * - Makes the tenant field visible in the admin UI within applicable collections
 *
 * @default false
 */
debug?: boolean
/**
 * Enables the multi-tenant plugin
 *
 * @default true
 */
enabled?: boolean
/**
 * Localization for the plugin
 */
i18n?: {
  translations: {
    [key in AcceptedLanguages]?: {
      /**
       * Shown inside 3 dot menu on edit document view
       *
       * @default 'Assign Tenant'
       */
      'assign-tenant-button-label'?: string
      /**
       * Shown as the title of the assign tenant modal
       *
       * @default 'Assign "{{title}}"'
       */
      'assign-tenant-modal-title'?: string
      /**
       * Shown as the label for the assigned tenant field in the assign tenant modal
       *
       * @default 'Assigned Tenant'
       */
      'field-assignedTenant-label'?: string
      /**
       * Shown as the label for the global tenant selector in the admin UI
       *
       * @default 'Filter by Tenant'
       */
      'nav-tenantSelector-label'?: string
    }
  }
}
/**
 * Field configuration for the field added to all tenant enabled collections
 */
tenantField?: RootTenantFieldConfigOverrides
/**
 * Field configuration for the field added to the users collection
 *
 * If `includeDefaultField` is `false`, you must include the field on your users collection manually
 * This is useful if you want to customize the field or place the field in a specific location
 */
tenantsArrayField?:
  | {
      /**
       * Access configuration for the array field
       */
      arrayFieldAccess?: ArrayField['access']
      /**
       * Name of the array field
       *
       * @default 'tenants'
       */
      arrayFieldName?: string
      /**
       * Name of the tenant field
       *
       * @default 'tenant'
       */
      arrayTenantFieldName?: string
      /**
       * When `includeDefaultField` is `true`, the field will be added to the users collection automatically
       */
      includeDefaultField?: true
      /**
       * Additional fields to include on the tenants array field
       */
      rowFields?: Field[]
      /**
       * Access configuration for the tenant field
       */
      tenantFieldAccess?: RelationshipField['access']
    }
  | {
      arrayFieldAccess?: never
      arrayFieldName?: string
      arrayTenantFieldName?: string
      /**
       * When `includeDefaultField` is `false`, you must include the field on your users collection manually
       */
      includeDefaultField?: false
      rowFields?: never
      tenantFieldAccess?: never
    }
/**
 * Customize tenant selector label
 *
 * Either a string or an object where the keys are i18n codes and the values are the string labels
 *
 * @deprecated Use `i18n.translations` instead.
 */
tenantSelectorLabel?:
  | Partial<{
      [key in AcceptedLanguages]?: string
    }>
  | string
/**
 * The slug for the tenant collection
 *
 * @default 'tenants'
 */
tenantsSlug?: string
/**
 * Function that determines if a user has access to _all_ tenants
 *
 * Useful for super-admin type users
 */
userHasAccessToAllTenants?: (
  user: ConfigTypes extends { user: unknown } ? ConfigTypes['user'] : User,
) => boolean
/**
 * Override the access result on the users collection access control functions
 *
 * The function receives:
 *  - accessResult: the original result from the access control function
 *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', 'unlock', or 'validate'
 *  - ...restOfAccessArgs: the original arguments passed to the access control function
 */
usersAccessResultOverride?: CollectionAccessResultOverride
/**
 * Opt out of adding access constraints to the tenants collection
 */
useTenantsCollectionAccess?: boolean
/**
 * Opt out including the baseListFilter to filter tenants by selected tenant
 */
useTenantsListFilter?: boolean
217
/**
 * Opt out including the baseListFilter to filter users by selected tenant
 */
useUsersTenantFilter?: boolean
222}

Basic Usage

In the plugins array of your Payload Config, call the plugin with options:

1import { buildConfig } from 'payload'
2import { multiTenantPlugin } from '@payloadcms/plugin-multi-tenant'
3import type { Config } from './payload-types'
4
5const config = buildConfig({
collections: [
  {
    slug: 'tenants',
    admin: {
      useAsTitle: 'name',
    },
    fields: [
      // remember, you own these fields
      // these are merely suggestions/examples
      {
        name: 'name',
        type: 'text',
        required: true,
      },
      {
        name: 'slug',
        type: 'text',
        required: true,
      },
      {
        name: 'domain',
        type: 'text',
        required: true,
      },
    ],
  },
],
plugins: [
  multiTenantPlugin<Config>({
    collections: {
      pages: {},
      navigation: {
        isGlobal: true,
      },
    },
  }),
],
43})
44
45export default config

Tenant write enforcement

Every create and update to a tenant-enabled collection is checked. If the request assigns a tenant that the user is not a member of, the write is rejected with a validation error on the tenant field.

This applies to the tenant a document starts in and the tenant it moves to. A user cannot create a new document in another tenant or move an existing document to another tenant.

The check runs on drafts and autosave saves as well as ordinary saves. Payload skips field validation for those operations, so the plugin also enforces membership in a collection beforeValidate hook.

What is checked

The tenant is compared with the tenants assigned to the user on the admin users collection. The check is skipped when:

The user passes your userHasAccessToAllTenants function
The user belongs to a different auth collection. These users do not have a tenants array, which matches how the plugin's access control treats them
The tenant is unchanged. An update that does not change the tenant field is not blocked by this check
The call comes from the Local API with no user, such as a seed script or a migration

All other writes are checked, including requests with no user. An unauthenticated request belongs to no tenant, so it cannot assign one. If a collection allows public creates and must set a tenant, do this in server-side code through the Local API instead of the request body.

Other auth collections

Users from an auth collection other than the tenant-managed collection cannot write the tenant field. Attempts to set or change the tenant are ignored. These users can still update other fields if the collection access rules allow it. This applies when the plugin adds the field, or when a customTenantField configuration passes adminUsersSlug to tenantField.

filterOptions on the tenant field controls which tenants the admin panel shows. It does not control which tenants the server accepts on write.

If you override filterOptions to show more tenants, the additional tenants are still rejected on save. Use userHasAccessToAllTenants to let a user write outside their assigned tenants.

The write check reads the user's tenant assignments instead of running the filterOptions query. This avoids a database read in the same transaction as the write.

Collections that place the tenant field themselves

Collections that use customTenantField receive the same collection-hook check. The field checks the user's explicit tenant assignments. If users depend on userHasAccessToAllTenants, pass that function to tenantField when you place it. The collection hook applies the check in all cases.

Access control also applies. A user who cannot update a document is rejected before the tenant is checked.

Front end usage

The plugin scaffolds out everything you will need to separate data by tenant. You can use the tenant field to filter data from enabled collections in your front-end application.

In your frontend you can query and constrain data by tenant with the following:

1const pagesBySlug = await payload.find({
collection: 'pages',
depth: 1,
draft: false,
limit: 1000,
overrideAccess: false,
where: {
  // your constraint would depend on the
  // fields you added to the tenants collection
  // here we are assuming a slug field exists
  // on the tenant collection, like in the example above
  'tenant.slug': {
    equals: 'gold',
  },
},
16})

NextJS rewrites

Using NextJS rewrites and this route structure /[tenantDomain]/[slug], we can rewrite routes specifically for domains requested:

1async rewrites() {
return [
  {
    source: '/((?!admin|api)):path*',
    destination: '/:tenantDomain/:path*',
    has: [
      {
        type: 'host',
        value: '(?<tenantDomain>.*)',
      },
    ],
  },
];
14}

React Hooks

Below are the hooks exported from the plugin that you can import into your own custom components to consume.

useTenantSelection

You can import this like so:

1import { useTenantSelection } from '@payloadcms/plugin-multi-tenant/client'
2
3...
4
5const tenantContext = useTenantSelection()

The hook returns the following context:

1type ContextType = {
/**
 * Array of options to select from
 */
options: OptionObject[]
/**
 * The currently selected tenant ID
 */
selectedTenantID: number | string | undefined
/**
 * Prevents a refresh when the tenant is changed
 *
 * If not switching tenants while viewing a "global",
 * set to true
 */
setPreventRefreshOnChange: React.Dispatch<React.SetStateAction<boolean>>
/**
 * Sets the selected tenant ID
 *
 * @param args.id - The ID of the tenant to select
 * @param args.refresh - Whether to refresh the page
 * after changing the tenant
 */
setTenant: (args: {
  id: number | string | undefined
  refresh?: boolean
}) => void
28}

Examples

The Examples Directory also contains an official Multi-Tenant example.

Was this page helpful?

See what others are building with Payload.

"Payload has transformed the way our clients manage content. It's an indispensable tool for any modern agency."

Get the resources you need to start building today

Microsoft chose Payload to tell the world about AI.