> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookfish.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization routing

> Add an explicit tenant namespace to Hookfish routes and database resolution.

Enable organization routing when each tenant needs an explicit request path
and database context in addition to resource-scoped credentials.

```ts theme={null}
export default defineHookfishConfig({
  db,
  organizationRouting: true,
  providers,
})
```

## Route changes

OAuth management routes move below the organization:

```text theme={null}
/api/organization/acme/oauth/providers
/api/organization/acme/oauth/connections
/api/organization/acme/oauth/authorize/github
/api/organization/acme/secrets
/api/organization/acme/admin/providers
```

Provider callbacks and MCP client metadata remain global:

```text theme={null}
/api/oauth/callback/github
/api/oauth/client-metadata/mcp
```

Stats and broker-token administration also remain deployment-wide.

## Enforce the namespace

The organization must be 1–128 characters using letters, numbers, dots,
underscores, or hyphens. Hookfish stores the validated organization separately
on authorization state and connection records.

Explicit connection IDs, connection prefixes, provider paths, and vault paths
must remain at or below the organization's resource path. For organization
`acme`, `acme/engineering/github` is valid and `other/github` is rejected.

Use both controls:

* Organization routing supplies an authenticated tenant context to the
  database adapter.
* Broker scopes restrict what the calling credential can access.

## Resolve tenant storage

Request-aware database adapters receive `{ organization }` as their context. A
shared PostgreSQL adapter can retain the organization as a row-level key. A
partitioned adapter can select a separate store.

<Note>
  The built-in browser facade exposes only global OAuth-management paths. Proxy
  organization operations through your authenticated application server and
  call Hookfish with the tenant's scoped broker token.
</Note>