Provisioning a tenant
The five steps of the Eved Auth wizard — tenant identity, password policy, token lifetimes, session limits, review.
Tenant provisioning is a five-step wizard inside the Eved Auth project. The full Eved walkthrough lives at Eved → Auth project; this page focuses on what each field means from the Auth perspective and what you can change afterwards.
Before you start
You need a workspace in Eved and the right to create projects inside it. If you do not have either, start at Eved → Getting started.
The wizard
Step 1 — Tenant identity
| Field | Constraint | Editable later |
|---|---|---|
tenantCode | 2–50 chars; lowercase + digits + hyphens + underscores; starts with a letter. | No — pick something stable. |
tenantName | 2–255 chars. Human-readable. | Yes. |
The tenantCode is what your application sends in every POST /login as the tenantCode field. It identifies your organization to the Auth service and is referenced in audit events forever.
Step 2 — Password policy
| Field | Default | Range / Meaning |
|---|---|---|
minLength | 8 | 6–128 characters. |
requireUppercase | true | At least one A–Z. |
requireNumbers | true | At least one digit. |
requireSpecialChars | false | At least one non-alphanumeric character. |
Applied on every POST /register and every password update. Violations return PASSWORD_POLICY_VIOLATION with a violations[] array. Editable from the Settings tab after the wizard.
Step 3 — Tokens
| Field | Default | Meaning |
|---|---|---|
accessTokenExpiration | 15 min | JWT exp window before a refresh is required. |
refreshTokenExpiration | 7 days | Refresh-token lifetime before the user must re-authenticate. |
Editable from Settings. Changes apply to newly issued tokens; existing tokens keep their original expiration.
Step 4 — Session
| Field | Default | Effect |
|---|---|---|
maxConcurrentSessions | 5 | Active refresh tokens allowed per user. |
enforceLogout | false | At the limit: true rejects new logins with SESSION_LIMIT_EXCEEDED; false evicts the oldest session. |
sessionTimeout | 30 min | Inactivity timeout. |
otpEnabled | false | Two-factor toggle. Schema reserved; not yet enforced. |
Editable from Settings. Existing sessions are not retroactively shortened.
Step 5 — Review & create
The wizard shows a read-only summary. Submitting provisions the tenant in the Auth service, seeds the super_admin role, and returns you to the project dashboard.
If creation fails — most often a duplicate tenantCode — the project is created in error status with the reason captured. Fix the value and retry from Settings.
What lands in your tenant
After the wizard succeeds, the tenant has:
- Your
authConfig— exactly what you entered in steps 2–4. - A seeded
super_adminrole with full permissions. - The system permission catalog (
users:*,roles:*,permissions:*,tenants:*,auth:*,tokens:*). - Zero users — see Registration for how to create the first one.
Bypass for advanced operators
Provisioning through the API directly is reserved for internal Febasi platform operations. As an external tenant, the Eved wizard is the supported and complete path.