Six nouns, and how they nest
ConceptsRekey uses a small set of words and it has not always used them consistently. Workspace and Tenant are the same thing. The rest are distinct, and mixing up operator and end user is the mistake that costs the most time.
Workspace
also called TenantTenantYour account on a Rekey deployment, the thing that owns Applications and the thing Rekey Cloud bills. The panel calls it a workspace, the database table is tenants, and the API path is /api/v1/tenant/workspace. Same row, three names.
Operator
TenantUser + TenantMembershipA human who signs in to the operator panel and runs a workspace. Operator email is unique across the whole deployment, and one operator can be a member of several workspaces with a role of OWNER, ADMIN or MEMBER in each.
Application
ApplicationOne product under a workspace, such as acme-prod or acme-staging. This is where isolation actually lives: every end user, key, plan, subscription and webhook carries an applicationId. The environment (PRODUCTION, STAGING, DEVELOPMENT) is set at creation and cannot be changed.
End user
EndUserSomebody who signs up to your product, not to Rekey. Email is unique per Application, so the same address in two Applications is two separate accounts, even inside one workspace.
Organization
OrganizationA team of end users inside one Application, with its own role catalog and its own slug. An organization can also be the beneficiary of a subscription, which is how you bill a company rather than a person.
Super-admin
SUPER_ADMIN_KEYNot a user account. It is one shared secret in the API's environment that covers the entire deployment, and it is what creates workspaces and sets their limits. On Rekey Cloud it is ours; self-hosting, it is yours. Treat a leak as total.
How they nest
A deployment holds workspaces, and only the super-admin key creates one. A workspace holds Applications, and the operators who run it sign in to the panel to do so. An Application holds everything else: its own API keys, its own auth settings, its own plans, and its own pool of end users, who never cross from one Application to another. Organizations sit inside an Application too, as named groups of that Application's end users, so an organization belongs to an Application rather than to the workspace above it. The one place the workspace reaches back down is counting: limits such as the maximum number of active end users are summed across every Application in the workspace, even though the identities themselves are per Application.
Two kinds of person, two kinds of key
You are an operator. Your customers are end users. They sign in to different places with different credentials, and no operator session ever authenticates against your Application.
- An Application's secret key (
rp_live_…on a production Application,rp_test_…otherwise) is your server acting as the Application. It never goes to a browser. - An Application's publishable key (
rp_pub_…) is safe in browser JavaScript. It identifies the Application, it authorizes nothing. - An end user's access token is that person. Per-user reads such as entitlements take it as an argument.
Next: the quickstart builds a signed-in page and a gated feature against these nouns.