tomazbracic
Hi,
I would like to find out the best way to start working on a multi-tenant SaaS product involving Elixir’s full-stack.
In the past, I already asked here about authentication and authorization, but without real luck. I am aware of Pow, Guardian, Phx.gen.auth… but somehow I still have a feeling that I will need to develop 2 products. The first one is my idea about Saas, and the second one is something to cover all these things around security.
I was looking into Keycloak, but I would rather avoid another external dependency.
Current tooling gives you the impression that all we have is basic support. Like the majority of products and use-cases would be running backends with minimum support for auth. Am I wrong? I mean I know I am, but I would like to challenge someone to give some useful feedback. Is there any real guide or tutorial or course on topics like Phx.gen.auth…
So I would like to build SaaS and use it as a multitenant platform with all sorts of roles behind and other modern options. And all that to be production-ready.
I would really like to get some guidance on where to go from here.
Thanks, T
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #blog-post
- #ai
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
kartheek
I don’t think you need to build anything from scratch, there are many good libraries out there.
You need answer few questions:
How do you distinguish the requests coming from different tenants in you multi-tenant app ? domain name or api key
What auth providers you will have for authentication - google, fb, etc
How will you provide auth through json endpoint or oauth2 web flow?
Few details about what SaaS platform it is or any references to an existing product? (to understand auth requirements)
Guardian is very mature library for security - GitHub - ueberauth/guardian: Elixir Authentication · GitHub .
I have built multi-tenant solution without phoenix auth and pow. They did not even exist back then.
LostKobrakai
Can you explain what “all sorts of roles behind and other modern options” is meant to mean? In my experience the reason why authentication/authorization libraries are often such a pain-point is that a library is used, which does handle that “stuff” just not in a way it would align well with project/business requirements – especially when faced with continuous development and maintenance.
stefanchrobot
I would be interested to understand more of your needs. What do you mean by multi-tenancy?
I have a simplistic understanding of multi-tenancy basically meaning that the app supports multiple accounts where each account has it’s own set of data including users. At least that’s how my app works. Each table has an
account_idcolumn, almost all context functions receive%Account{}as the first argument. I find that manageable, though my app is pretty small. I support username+password authentication plus access token based for the mobile app API. I’m not a fan of generators, but I mostly got my code out ofphx.gen.auth.