# Organizations B2B setup

## 1. Create the organization

Dashboard > Organizations > Create. You get an org_id (`org_xxx`) and a name. Use the id in code; names can change.

## 2. Enable connections on the org

Organizations > your org > Connections > Enable Connection. Org logins ONLY offer org-enabled connections; app-level enablement is not enough. Options:

- One database connection per org (isolated user pools), or
- A shared database connection with org membership controlling access, or
- Enterprise connections per customer (their IdP).

Just-in-time membership: on the org connection settings, turn on JIT so users logging in through that connection auto-join the org. This removes most invitation toil.

## 3. Add members

Invite via email (Organizations > Members > Invite) or assign directly. Invitations expire in 7 days and are bound to the invited email. For bulk onboarding prefer JIT.

## 4. Log in with the org context

Every authorize call must pass the organization:

```
authorizationParams: { organization: "org_xxx" }
```

Without it, the user logs in outside the org context: no org roles, no org claims, and org-required apps fail. Silent auth calls need it too.

For multi-tenant callback URLs, use the `{organization_name}` placeholder in Allowed Callback URLs on domains you control.

## 5. Tokens

The access token carries an `org_id` claim. Org roles land in the token when RBAC is on and the login had org context. Your API should check `org_id` against the tenant being accessed.

## Checklist

- Connection enabled on the org, not just the app.
- organization passed on login, silent auth, and invite acceptance.
- API authorizes on org_id, not just user identity.