Hmm, as long as User is not global, the multitenancy :bypass does not help, right?
My idea was to keep it like that but tell Ash (or make it figure out) the correct tenant before trying to read the actual user record in the end.
Anyway, for now I completely removed multitenancy for User – should be good enough to get started. 
Right 
yeah, we may need to add more consideration there, like encode the tenant into the api key in some way. Looks like a scenario I didn’t think through fully 
Wouldn’t it be a way to extend AshAuthentication.Strategy.ApiKey.SignInPreparation to
ApiKey) belongs to the tenant entity resource (Organisation)User)?Might play around some more tomorrow…
Ash doesn’t know about a “multitenancy resource”. It would likely require some kind of configuration/hook of some kind.