Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Prefect Community

&gt; Since API keys can be used across tenants if linked to a user account, you may also pass a tenant:
&gt; <https://docs-v1.prefect.io/orchestration/concepts/api.html#authenticating-the-client-with-cloud>
What are the difference between "Tenants" and "Workspaces"? I might not fully understand those 2 keywords the right way

image.png

Can I have multiple tenants in my config file using the same (or not) API key?

So i believe in the auth.toml file you add in your user creds and a user can be added to tenant

Do you have an example ?

Because I cannot achieve that with the CLI. It will always override it and I can only have one set of credentials so far ...

err.... I meant that rather than added multiple user creds to your auth.toml, rather you would invite that single user to multiple tenants. I haven't tried using multiple user creds, so I am not srue on that one, but I can look into it/try it right now

&gt; rather you would invite that single user to multiple tenants
How is that achievable?

Typically when I invite someone I just log into cloud go to team and click invite. Then add their email associated with the account. That's probably the easiest way to do it

You can invite a user even if they are already added to a different tenant

That's what I did but are the service_accounts (or api_keys) per tenant or global per user?

So yeah it sounds like I need to choose a specific tenant when creating an api_key. Which is very inconvenient when I do `prefect auth login`

This is why I don't understand how I could make `prefect auth switch-tenants` working :shrug:

So I've never had issues with using the `prefect auth switch-tenants.`  It should work if your user is invited to the tenant and you accept the invite. I think the tenant that you select is just the default tenant

Is this merely an issue of wanting to understand how it works or is the switch-tenants command not working for you?

So I guess I need to create multiple API Keys for the same user?  :thinking_face: This is pretty confusing

And why a user could not reuse the same api_key to connect to multiple tenants?

Real quick could you try running `prefect auth login -k {proto-tenant key}`

and then after that run `prefect auth list-tenants`

Another API key I generate on the proto tenant for my account?

I now see the 3 of them even I only create an api_key for the staging one :thinking_face:

Confusing

I can switch between them now but don't understand why I need to specify a tenant when I create a new api_key ...

the reason why you need to specify a tenant is to associate that key with a tenant. You can change the default tenant by running `prefect auth switch-tenant` though. Try switching tenants now, it should work