# Tenants and environments

A **tenant** is your account and billing entity. Everything you create belongs to exactly one tenant, and no other tenant can read it.

```text
Tenant
 ├── Environments: live, test
 ├── Members (staff with roles)
 ├── Organizations (brands, venues, creators)
 │    └── product resources (events, fanbases, products, streams)
 ├── Customers (your end users)
 └── API keys, webhook endpoints, integrations, domains
```

## Environments

Each tenant has a **live** and a **test** environment. Every object carries `livemode`: `true` for live and `false` for test. The two never mix, and the key you use decides which one you are in.

Test mode routes payments to a simulator, captures messages and uses test media. See [test mode](https://docs.vabu.live/concepts/test-mode.md).

## How a request finds its tenant

Vabu OS checks these in order and uses the first match.

1. A secret or restricted key in `Authorization: Bearer ...`. It carries the tenant, environment and scopes.
2. A publishable key in `Vabu-Publishable-Key`, or the `key` query parameter on public embeds.
3. A user access token. The tenant comes from the token's `tid` claim. If a staff member belongs to several tenants, send `Vabu-Tenant` to choose one.
4. A custom domain, for whitelabel pages.
5. The legacy `X-Tenant-Code` header, kept for existing tenant apps until they move to publishable keys.

## Isolation

Tenant isolation is enforced in the application and again in the database, and every new endpoint is tested to prove one tenant's key cannot read or write another tenant's data. You do not need to add tenant filters to your own calls.

## Organizations and customers

An **organization** is a brand, venue or creator inside your tenant. Product resources such as events and streams belong to an organization.

A **customer** is one of your end users. Whether a person arrived through Vabu ID, your own tokens or a server call, they are a customer in your tenant. You can attach your own ID with [`external_id`](https://docs.vabu.live/concepts/metadata.md).

## Members

Members are your staff. Membership is explicit: being signed in does not make anyone a member. Roles control what a member can do in the console and API.