# Organizations B2B setup
## 1. Create the organization
Dashboard > Organizations > Create. You get an org_id (`org_xxx`) and a name. Use the id in code; names can change.
## 2. Enable connections on the org
Organizations > your org > Connections > Enable Connection. Org logins ONLY offer org-enabled connections; app-level enablement is not enough. Options:
- One database connection per org (isolated user pools), or
- A shared database connection with org membership controlling access, or
- Enterprise connections per customer (their IdP).
Just-in-time membership: on the org connection settings, turn on JIT so users logging in through that connection auto-join the org. This removes most invitation toil.
## 3. Add members
Invite via email (Organizations > Members > Invite) or assign directly. Invitations expire in 7 days and are bound to the invited email. For bulk onboarding prefer JIT.
## 4. Log in with the org context
Every authorize call must pass the organization:
```
authorizationParams: { organization: "org_xxx" }
```
Without it, the user logs in outside the org context: no org roles, no org claims, and org-required apps fail. Silent auth calls need it too.
For multi-tenant callback URLs, use the `{organization_name}` placeholder in Allowed Callback URLs on domains you control.
## 5. Tokens
The access token carries an `org_id` claim. Org roles land in the token when RBAC is on and the login had org context. Your API should check `org_id` against the tenant being accessed.
## Checklist
- Connection enabled on the org, not just the app.
- organization passed on login, silent auth, and invite acceptance.
- API authorizes on org_id, not just user identity.