Hanko v3: Multitenancy

Hanko v3 introduces native multi-tenancy, allowing a single Hanko API deployment to manage any number of isolated tenants. Each tenant has its own user pool and authentication configuration.

Previously, Hanko was designed as a single-tenant, cloud-native application. Scaling multiple projects required running separate Hanko API instances, which we managed in Hanko Cloud using our Kubernetes operator.

With Hanko v3, a single Hanko API instance can now serve either one tenant or multiple tenants.

Multi-tenancy

• The Hanko API can manage a single tenant or multiple isolated tenants.
• Each tenant has its own user pool and authentication configuration.
• Tenant-specific configuration is stored in the database when running in multi-tenant mode.
• The Tenant Management API specification will be published separately.

Single-tenant mode

Hanko v3 can still be deployed in single-tenant mode.

YAML-based configuration continues to work as before (refer to the configuration options reference), making it possible to upgrade without migrating tenant configuration into the database.

Global configuration

Multi-tenant deployments still require a global configuration file or environment variables.

This configuration contains settings that apply to the entire Hanko API deployment rather than to an individual tenant, including:

• Database connection settings
• Server and infrastructure configuration
• Other cross-tenant settings

Breaking changes

Deprecated API endpoints have been removed.

See the migration guide for details and instructions:

https://docs.hanko.io/guides/migrations/2.x.x-to-3.x.x

What's changed

• chore(deps): bump react-router and react-router-dom in /frontend by @dependabot[bot] in #2653
• fix: upgrade invopop/jsonschema to v0.14.0 (wk8 → pb33f ordered-map) by @loeffert in #2644
• chore(deps): bump @tootallnate/once from 2.0.0 to 2.0.1 in /frontend by @dependabot[bot] in #2639
• chore(deps-dev): bump js-cookie from 3.0.5 to 3.0.8 in /frontend by @dependabot[bot] in #2638
• chore(deps-dev): bump turbo from 2.9.5 to 2.9.14 in /frontend by @dependabot[bot] in #2637
• chore(deps): bump next from 16.2.3 to 16.2.6 in /frontend by @dependabot[bot] in #2636
• chore(deps): bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 in /frontend by @dependabot[bot] in #2635
• chore(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 in /frontend by @dependabot[bot] in #2634
• chore(deps): bump ip-address and express-rate-limit in /frontend by @dependabot[bot] in #2632
• chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 in /backend by @dependabot[bot] in #2630
• chore(deps-dev): bump hono from 4.12.2 to 4.12.23 in /frontend by @dependabot[bot] in #2650
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 in /backend by @dependabot[bot] in #2625
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/kms from 1.50.4 to 1.50.5 in /backend by @dependabot[bot] in #2619
• chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /frontend by @dependabot[bot] in #2623
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #2616
• chore(deps-dev): bump turbo from 2.9.14 to 2.9.16 in /frontend by @dependabot[bot] in #2661
• chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 in /backend by @dependabot[bot] in #2656
• fix: firebase cmd by @lfleischmann in #2654
• fix: commit nextjs tsconfig auto-change on build by @lfleischmann in #2667
• chore(deps-dev): bump webpack-cli from 7.0.2 to 7.0.3 in /frontend by @dependabot[bot] in #2658
• chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.16 to 1.32.24 in /backend by @dependabot[bot] in #2665
• chore(deps): bump github.com/go-playground/validator/v10 from 10.30.2 to 10.30.3 in /backend by @dependabot[bot] in #2657
• chore(deps-dev): bump sass from 1.99.0 to 1.100.0 in /frontend by @dependabot[bot] in #2659
• chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #2615
• chore(deps): bump github.com/labstack/gommon from 0.4.2 to 0.5.0 in /backend by @dependabot[bot] in #2621
• chore(deps): bump github.com/gobuffalo/pop/v6 from 6.2.1 to 6.3.0 in /backend by @dependabot[bot] in #2622
• chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.24 to 1.32.25 in /backend by @dependabot[bot] in #2676
• chore(deps): bump github.com/knadh/koanf/v2 from 2.3.4 to 2.3.5 in /backend by @dependabot[bot] in #2673
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/kms from 1.50.5 to 1.53.4 in /backend by @dependabot[bot] in #2672
• chore(deps-dev): bump @vitejs/plugin-vue from 6.0.5 to 6.0.7 in /frontend by @dependabot[bot] in #2662
• chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 in /backend by @dependabot[bot] in #2680
• chore(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 in /backend by @dependabot[bot] in #2682
• chore(deps-dev): bump jiti from 2.6.1 to 2.7.0 in /frontend by @dependabot[bot] in #2684
• chore(deps-dev): bump hono from 4.12.23 to 4.12.26 in /frontend by @dependabot[bot] in #2693
• chore(deps): bump github.com/labstack/echo/v4 from 4.15.1 to 4.15.4 in /backend by @dependabot[bot] in #2690
• chore(deps): bump form-data from 4.0.5 to 4.0.6 in /frontend by @dependabot[bot] in #2688
• chore(deps-dev): bump tar from 7.5.9 to 7.5.16 in /frontend by @dependabot[bot] in #2687
• chore(deps): bump launch-editor from 2.12.0 to 2.14.1 in /frontend by @dependabot[bot] in #2686
• chore(deps): bump github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0 in /backend by @dependabot[bot] in #2674
• chore(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 in /backend by @dependabot[bot] in #2695
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2698
• chore(deps): bump github.com/opencontainers/runc from 1.2.8 to 1.3.6 in /backend by @dependabot[bot] in #2697
• Update translation for 'passkey' in German by @FlxMgdnz in #2704
• Multitenancy by @FreddyDevelop in #2702
• chore: increase frontend version numbers by @FreddyDevelop in #2707
• chore: autogenerate config JSON schema by @github-actions[bot] in #2705
• fix: preserve the original auditLog error by @FreddyDevelop in #2718
• log: add detailed error context for third-party internal errors by @FreddyDevelop in #2719
• refactor: remove TenantID validation in token model by @FreddyDevelop in #2720
• fix: set tenantID when saving password by @FreddyDevelop in #2721

Full Changelog: backend/v2.7.0...backend/v3.0.4