Just getting into multi-tenancy and the Ash support for it. My schema looks like: Organisation (global, tenant entity) Identity (global) —(has many)—> User (tenant) User (tenant) —(has many)—> Project (tenant) Token (global) So if a User has a record, it means the Identity belongs to the same O…

Tokens are not necessarily JWTs. It is the token resource that we use to store api keys.

Actually, let me double check myself on that front.

Yeah, I’m just misremembering the implementation. We should not be requiring that. Fixed here: fix: don't require token resource for API keys · team-alembic/ash_authentication@b95b22e · GitHub

Ok, tried with latest version. Now it says for User: ** (EXIT from #PID<0.94.0>) an exception was raised: ** (Spark.Error.DslError) authentication -> session_identifier: Must set `authentication.session_identifier` to either `:jti` or `:unsafe`, unless `authentication.tokens.require_token_pre…

Looks like just another check I need to fix :smiley:

Yay, was able to create a token! Thank you, Zach! Found a GraphQL error message that might deserve proper handling. Just FYI, optional cosmetics for now… :wink: { "data": { "createProject": { "errors": [ { "message": "something went wrong. Unique error id: `892f6ed9…

Hmm…that one is interesting. So the reason we did that is that externally the term for a tenant might be something other than “tenant”, so it would make sense to have you implement that yourself. There is a guide on doing that IIRC.

Ok, I introduced some denormalisation to avoid walking the tenant tables: Organisation (global, tenant entity) —(has many)—> ApiKey (global) User (tenant) —(has many)—> ApiKey (global) I want to authenticate User (tenant) via ApiKey (global): defmodule User do actions do read :sign_in_with…

Ah, interesting. I think what you can do is allow bypassing multi tenancy for that read action, since every api key will uniquely be uniquely identified. read :sign_in_with_api_key do argument :api_key, :string, allow_nil?: false prepare AshAuthentication.Strategy.ApiKey.SignInPrepa…

Elixir Programming Language Forum

AshAuthentication with multi-tenancy and API keys strategy

Questions & Help Questions

zachdaniel July 1, 2025, 5:04pm 7

You can try main again.