Skip to content
NextiaNextia Learning

Authentication, Permissions and Multi-Tenant Applications

Make one API safe for two organizations. You add sign-in, roles and organization boundaries to Larkfield's ticket API, so that every request answers three questions on the server — who is calling, what may they do, and in which organization — and you prove it with tests that try to break it.

Start course See the curriculum

Read every lesson as a guest, or sign in to enroll and track your progress.

What you'll learn

By the end of this course, you will be able to:

  • Distinguish authentication, authorization and tenant context.
  • Explain OAuth/OIDC and session/token flows.
  • Enforce permissions on the server.
  • Test isolation across records, files, retrieval and background work.

About this course

Larkfield’s help desk now serves a second shop, Bramble Books, from the same ticket API and the same database. One shared API key was enough when only Larkfield’s own tools called the API. It is not enough now. A key says that the caller is trusted, but not which person is calling, what that person may do, or which shop’s tickets they may see.

In this course, you add the missing answers, one change at a time. You model users, organizations, memberships and roles. You sign people in through a local identity provider that issues signed tokens, and you make the API check every token it receives. You give the browser a safe session and decide what happens at expiry, logout and account switching.

Then you enforce access on the server for every route, query, file link, search and cached answer, so that a guessed ticket ID from the other shop finds nothing. You keep background jobs and support staff inside the same rules. Finally, you test every user against every route in both shops, and you write down the design for the team that runs it.

Everything runs on your computer: the API, PostgreSQL, the object storage and the identity provider. Every token, error and test result in the lessons comes from a real run. All the people, shops and tickets are made up.

Before you start

You completed Build and Deploy Your First API and Databases and Storage for AI Applications, or you have the same skills. You do not need an account or money. The identity provider in the course is a small mock that runs on your computer; a real provider is optional and described step by step.

Courses to take first: Build and Deploy Your First API, Databases and Storage for AI Applications.

Who this is for

People who can build a small API and store its data in PostgreSQL, as in Build and Deploy Your First API and Databases and Storage for AI Applications, and now need users, roles and more than one customer organization in the same application. Developers and AI engineers who must sign people in and keep each organization's data apart.

How we made this course

Experienced AI practitioners designed this course. AI helped us draft the content; people chose the teaching approach and the examples, and reviewed every lesson. The outputs that you see are the actual results of running the code. How we make our courses

Inside the course

Module 1Identity and permission basics

3 lessons

Ask three questions of every request. Separate who the caller is, what they may do and in which organization, model users, memberships and roles, and see how a guessed ID or a hidden button fails.

  1. Three separate questions45 min
  2. Users and organizations55 min
  3. Threat examples50 min

Module 3Sessions and application integration

3 lessons

Keep the browser's session safe. Compare a session cookie with tokens kept in the browser, handle expiry, refresh, sign-out and account switching, and check that the provider and the API agree on every setting, also with a real provider.

  1. Browser session choices50 min
  2. Session lifecycle55 min
  3. Provider configuration50 min

Module 5Background work and administration

3 lessons

Keep permissions right over time. Re-check who asked for a background job when it runs, give support staff audited, time-limited access, and measure how long access lasts after a member is removed.

  1. Job identity context50 min
  2. Privileged operations50 min
  3. Lifecycle changes55 min

Module 6Validate and document the design

3 lessons

Prove it and hand it over. Test every user, route and organization in one matrix of negative tests, record an audit trail without tokens, and document the design for another team.

  1. Negative testing55 min
  2. Auditability45 min
  3. Handoff45 min

Final module · choose at least oneCase studies

2 case studies

Two end-to-end case studies. Audit the organization boundaries of an open-source application on your computer, and add sign-in and roles to the API course's case-study API. Complete at least one for the certificate; each one is a portfolio piece.

Complete at least one case study for the certificate. The others are optional. What each one covers

  1. Audit access control in an open-source multi-tenant app120 min
  2. Add sign-in and roles to an existing API240 min

After the case studiesFinal assignment

Use every module in one practice project. You collect evidence, and check it against the course outcomes.

  1. Final assignment180 min

Case studies

Realistic projects from start to finish, on real data, with every output explained. Each one makes a portfolio piece. Complete at least one for the certificate; the others are optional.

  1. Audit access control in an open-source multi-tenant app2 hr

    Run a permissively licensed open-source multi-tenant application on your computer, map its users, organizations and roles, and test its isolation with the course's access matrix.

  2. Add sign-in and roles to an existing API4 hr

    Add the mock identity provider, token validation and roles to the data API of the API course's case study, test it with an access matrix, then map the design to a real identity provider.

Reviews

Loading the reviews…

    Took this course? Sign in to review it. Learners can write a review after they complete 25% of the lessons.

    Share this course