# Tenants

A **tenant** is a single, isolated Allegro organization running on your instance. Each tenant has its own database, its own JWT signing keys, and its own audience, templates, and settings. The **Landlord** area is the control plane where super administrators manage every tenant on the instance.

Super administrators only

Creating and managing tenants is restricted to super administrators. Regular operators sign in to a single tenant and never see the Landlord area. Super admins can jump into any tenant — and back to the Landlord dashboard — from the tenant switcher.

## Creating a tenant[​](#creating-a-tenant "Direct link to Creating a tenant")

1. Open **Landlord → Tenants**.

2. Click **New tenant**.

3. Fill in the dialog:

   | Field    | Rules                                                                                                                                |
   | -------- | ------------------------------------------------------------------------------------------------------------------------------------ |
   | **Name** | Required. Up to 255 characters. Letters, numbers, spaces, and dashes only — e.g. `Acme News`.                                        |
   | **Slug** | Required. 3–255 characters, URL-safe (letters, numbers, dashes, underscores). Must be unique across the instance — e.g. `acme-news`. |

   The slug is generated automatically from the name as you type, until you edit the slug field yourself. Whatever you enter is normalized to a URL-safe value before it is saved, so a name like `Acme News` becomes the slug `acme-news`.

4. Click **Create**. Allegro provisions the tenant and takes you to its detail page.

## What provisioning does[​](#what-provisioning-does "Direct link to What provisioning does")

Tenant creation is synchronous — by the time you land on the new tenant's page, it is ready to use. Provisioning:

* **Creates and migrates the tenant's database**, giving it an isolated schema separate from every other tenant.
* **Generates the tenant's initial JWT signing key** — an RS256 (RSA-2048) key pair used to sign member session tokens. The public half is served from the tenant's [JWKS endpoint](/developer/guides/jwt.md) so you can verify those tokens in your own infrastructure.
* **Loads the compiled `client.js` asset** into the tenant so the browser SDK is immediately available.

Loading the client asset is best-effort: if the compiled asset isn't available when the tenant is created, provisioning still succeeds and the asset is loaded on the next build or asset refresh.

Give the tenant a domain

A new tenant is reachable at its subdomain (for example `acme-news.allegrocdp.com`). To serve the SDK from a domain you control, follow the [Custom Domain](/developer/platform/custom-domain.md) guide.