Multi-Tenant Plugin

https://www.npmjs.com/package/@payloadcms/plugin-multi-tenant

This plugin sets up multi-tenancy for your application from within your Admin Panel. It does so by adding a tenant field to all specified collections. Your front-end application can then query data by tenant. You must add the Tenants collection so you control what fields are available for each tenant.

Core features

Adds a tenant field to each specified collection
Adds a tenant selector to the admin panel, allowing you to switch between tenants
Filters list view results by selected tenant
Filters relationship fields by selected tenant
Ability to create "global" like collections, 1 doc per tenant
Automatically assign a tenant to new documents
Rejects writes that assign a tenant the user is not a member of

Installation

Install the plugin using any JavaScript package manager like pnpm, npm, or Yarn:

1pnpm add @payloadcms/plugin-multi-tenant

Options

The plugin accepts an object with the following properties:

1type MultiTenantPluginConfig<ConfigTypes = unknown> = {
/**
 * Base path for your application
 *
 * https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath
 *
 * @default undefined
 */
basePath?: string
/**
 * After a tenant is deleted, the plugin will attempt to clean up related documents
 * - removing documents with the tenant ID
 * - removing the tenant from users
 *
 * @default true
 */
cleanupAfterTenantDelete?: boolean
/**
 * Automatically
 */
collections: {
  [key in CollectionSlug]?: {
    /**
     * Override the access result from the collection access control functions
     *
     * The function receives:
     *  - accessResult: the original result from the access control function
     *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', or 'unlock'
     *  - ...restOfAccessArgs: the original arguments passed to the access control function
     */
    accessResultOverride?: CollectionAccessResultOverride
    /**
     * Opt out of adding the tenant field and place
     * it manually using the `tenantField` export from the plugin
     *
     * Tenant membership is still enforced on write. See Tenant write enforcement.
     */
    customTenantField?: boolean
    /**
     * Set to `true` if you want the collection to behave as a global
     *
     * @default false
     */
    isGlobal?: boolean
    /**
     * Overrides for the tenant field, will override the entire tenantField configuration
     */
    tenantFieldOverrides?: CollectionTenantFieldConfigOverrides
    /**
     * Set to `false` if you want to manually apply the baseListFilter
     * Set to `false` if you want to manually apply the baseFilter
     *
     * @default true
     */
    useBaseFilter?: boolean
    /**
     * @deprecated Use `useBaseFilter` instead. If both are defined,
     * `useBaseFilter` will take precedence. This property remains only
     * for backward compatibility and may be removed in a future version.
     *
     * Originally, `baseListFilter` was intended to filter only the List View
     * in the admin panel. However, base filtering is often required in other areas
     * such as internal link relationships in the Lexical editor.
     *
     * @default true
     */
    useBaseListFilter?: boolean
    /**
     * Set to `false` if you want to handle collection access manually without the multi-tenant constraints applied
     *
     * @default true
     */
    useTenantAccess?: boolean
  }
}
/**
 * Enables debug mode
 * - Makes the tenant field visible in the admin UI within applicable collections
 *
 * @default false
 */
debug?: boolean
/**
 * Enables the multi-tenant plugin
 *
 * @default true
 */
enabled?: boolean
/**
 * Localization for the plugin
 */
i18n?: {
  translations: {
    [key in AcceptedLanguages]?: {
      /**
       * Shown inside 3 dot menu on edit document view
       *
       * @default 'Assign Tenant'
       */
      'assign-tenant-button-label'?: string
      /**
       * Shown as the title of the assign tenant modal
       *
       * @default 'Assign "{{title}}"'
       */
      'assign-tenant-modal-title'?: string
      /**
       * Shown as the label for the assigned tenant field in the assign tenant modal
       *
       * @default 'Assigned Tenant'
       */
      'field-assignedTenant-label'?: string
      /**
       * Shown as the label for the global tenant selector in the admin UI
       *
       * @default 'Filter by Tenant'
       */
      'nav-tenantSelector-label'?: string
    }
  }
}
/**
 * Field configuration for the field added to all tenant enabled collections
 */
tenantField?: RootTenantFieldConfigOverrides
/**
 * Field configuration for the field added to the users collection
 *
 * If `includeDefaultField` is `false`, you must include the field on your users collection manually
 * This is useful if you want to customize the field or place the field in a specific location
 */
tenantsArrayField?:
  | {
      /**
       * Access configuration for the array field
       */
      arrayFieldAccess?: ArrayField['access']
      /**
       * Name of the array field
       *
       * @default 'tenants'
       */
      arrayFieldName?: string
      /**
       * Name of the tenant field
       *
       * @default 'tenant'
       */
      arrayTenantFieldName?: string
      /**
       * When `includeDefaultField` is `true`, the field will be added to the users collection automatically
       */
      includeDefaultField?: true
      /**
       * Additional fields to include on the tenants array field
       */
      rowFields?: Field[]
      /**
       * Access configuration for the tenant field
       */
      tenantFieldAccess?: RelationshipField['access']
    }
  | {
      arrayFieldAccess?: never
      arrayFieldName?: string
      arrayTenantFieldName?: string
      /**
       * When `includeDefaultField` is `false`, you must include the field on your users collection manually
       */
      includeDefaultField?: false
      rowFields?: never
      tenantFieldAccess?: never
    }
/**
 * Customize tenant selector label
 *
 * Either a string or an object where the keys are i18n codes and the values are the string labels
 *
 * @deprecated Use `i18n.translations` instead.
 */
tenantSelectorLabel?:
  | Partial<{
      [key in AcceptedLanguages]?: string
    }>
  | string
/**
 * The slug for the tenant collection
 *
 * @default 'tenants'
 */
tenantsSlug?: string
/**
 * Function that determines if a user has access to _all_ tenants
 *
 * Useful for super-admin type users
 */
userHasAccessToAllTenants?: (
  user: ConfigTypes extends { user: unknown }
    ? ConfigTypes['user']
    : TypedUser,
) => boolean
/**
 * Override the access result on the users collection access control functions
 *
 * The function receives:
 *  - accessResult: the original result from the access control function
 *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', or 'unlock'
 *  - ...restOfAccessArgs: the original arguments passed to the access control function
 */
usersAccessResultOverride?: CollectionAccessResultOverride
/**
 * Opt out of adding access constraints to the tenants collection
 */
useTenantsCollectionAccess?: boolean
/**
 * Opt out including the baseListFilter to filter tenants by selected tenant
 */
useTenantsListFilter?: boolean
219
/**
 * Opt out including the baseListFilter to filter users by selected tenant
 */
useUsersTenantFilter?: boolean
224}

Basic Usage

In the plugins array of your Payload Config, call the plugin with options:

1import { buildConfig } from 'payload'
2import { multiTenantPlugin } from '@payloadcms/plugin-multi-tenant'
3import type { Config } from './payload-types'
4
5const config = buildConfig({
collections: [
  {
    slug: 'tenants',
    admin: {
      useAsTitle: 'name',
    },
    fields: [
      // remember, you own these fields
      // these are merely suggestions/examples
      {
        name: 'name',
        type: 'text',
        required: true,
      },
      {
        name: 'slug',
        type: 'text',
        required: true,
      },
      {
        name: 'domain',
        type: 'text',
        required: true,
      },
    ],
  },
],
plugins: [
  multiTenantPlugin<Config>({
    collections: {
      pages: {},
      navigation: {
        isGlobal: true,
      },
    },
  }),
],
43})
44
45export default config

Tenant write enforcement

Every create and update to a tenant-enabled collection is checked. If the request assigns a tenant that the user is not a member of, the write is rejected with a validation error on the tenant field.

This applies to the tenant a document starts in and the tenant it moves to, so a user cannot put a new document into another tenant, or move one of their own documents into another tenant.

The check runs on drafts and autosave saves as well as ordinary saves. Payload skips field validation for those, so the plugin enforces membership in a collection beforeValidate hook.

What is checked

The tenant is compared against the tenants assigned to the user on the admin users collection. The check is skipped when:

The user passes your userHasAccessToAllTenants function
The user belongs to a different auth collection. Those users have no tenants array, which matches how the plugin's access control treats them
The tenant is unchanged. An update that does not touch the tenant field is never blocked by this check
The call comes from the Local API with no user, such as a seed script or a migration

Everything else is checked, including requests with no user. An unauthenticated request belongs to no tenant, so it cannot name one. If a collection allows public creates and needs to set a tenant, do it from server-side code through the Local API rather than from the request body.

Other auth collections

Users from an auth collection other than the tenant-managed one cannot write the tenant field at all. The field grants create and update access only to that collection, so their attempts to set or change the tenant are ignored rather than applied. They may still update other fields on a document if your own access control allows it — only the tenant field is locked. This is enforced when the plugin adds the field, or when a customTenantField config passes adminUsersSlug to tenantField.

filterOptions on the tenant field decides which tenants the admin panel offers in the dropdown. It does not decide which tenants the server accepts on write.

If you override filterOptions to widen the list, the extra tenants appear in the dropdown but are still refused on save. Use userHasAccessToAllTenants to let a user write outside their assigned tenants.

The write check deliberately reads the user's tenant assignments rather than running your filterOptions query. Resolving filterOptions means a database read inside the same transaction as the write, which conflicts with the reads other relationship fields make at the same time.

Collections that place the tenant field themselves

Collections using customTenantField are covered by the same check. The field enforces it against the user's explicit tenant assignments, so if any of your users rely on userHasAccessToAllTenants, pass that function to tenantField when you place it — otherwise the field cannot recognise those users and rejects their writes to tenants they are not directly assigned to. The collection hook enforces the check either way.

Access control still applies on top of all of this. A user who cannot update a document at all is refused before the tenant is looked at.

Front end usage

The plugin scaffolds out everything you will need to separate data by tenant. You can use the tenant field to filter data from enabled collections in your front-end application.

In your frontend you can query and constrain data by tenant with the following:

1const pagesBySlug = await payload.find({
collection: 'pages',
depth: 1,
draft: false,
limit: 1000,
overrideAccess: false,
where: {
  // your constraint would depend on the
  // fields you added to the tenants collection
  // here we are assuming a slug field exists
  // on the tenant collection, like in the example above
  'tenant.slug': {
    equals: 'gold',
  },
},
16})

NextJS rewrites

Using NextJS rewrites and this route structure /[tenantDomain]/[slug], we can rewrite routes specifically for domains requested:

1async rewrites() {
return [
  {
    source: '/((?!admin|api)):path*',
    destination: '/:tenantDomain/:path*',
    has: [
      {
        type: 'host',
        value: '(?<tenantDomain>.*)',
      },
    ],
  },
];
14}

React Hooks

Below are the hooks exported from the plugin that you can import into your own custom components to consume.

useTenantSelection

You can import this like so:

1import { useTenantSelection } from '@payloadcms/plugin-multi-tenant/client'
2
3...
4
5const tenantContext = useTenantSelection()

The hook returns the following context:

1type ContextType = {
/**
 * Array of options to select from
 */
options: OptionObject[]
/**
 * The currently selected tenant ID
 */
selectedTenantID: number | string | undefined
/**
 * Prevents a refresh when the tenant is changed
 *
 * If not switching tenants while viewing a "global",
 * set to true
 */
setPreventRefreshOnChange: React.Dispatch<React.SetStateAction<boolean>>
/**
 * Sets the selected tenant ID
 *
 * @param args.id - The ID of the tenant to select
 * @param args.refresh - Whether to refresh the page
 * after changing the tenant
 */
setTenant: (args: {
  id: number | string | undefined
  refresh?: boolean
}) => void
28}

Examples

The Examples Directory also contains an official Multi-Tenant example.

Was this page helpful?

See what others are building with Payload.

"Payload has transformed the way our clients manage content. It's an indispensable tool for any modern agency."

Get the resources you need to start building today

Microsoft chose Payload to tell the world about AI.