Skip to main content
Enable organization routing when each tenant needs an explicit request path and database context in addition to resource-scoped credentials.

​
Route changes

OAuth management routes move below the organization:
Provider callbacks and MCP client metadata remain global:
Stats and broker-token administration also remain deployment-wide.

​
Enforce the namespace

The organization must be 1–128 characters using letters, numbers, dots, underscores, or hyphens. Hookfish stores the validated organization separately on authorization state and connection records. Explicit connection IDs, connection prefixes, provider paths, and vault paths must remain at or below the organization’s resource path. For organization acme, acme/engineering/github is valid and other/github is rejected. Use both controls:
  • Organization routing supplies an authenticated tenant context to the database adapter.
  • Broker scopes restrict what the calling credential can access.

​
Resolve tenant storage

Request-aware database adapters receive { organization } as their context. A shared PostgreSQL adapter can retain the organization as a row-level key. A partitioned adapter can select a separate store.
The built-in browser facade exposes only global OAuth-management paths. Proxy organization operations through your authenticated application server and call Hookfish with the tenant’s scoped broker token.