Workspaces & Tenants
AppBlocks Cloud is built for one vendor serving many customers. You design the solution once, in a workspace. Each of your customers gets a tenant inside that workspace — a ready-made copy of everything you built, where all they have to do is plug in their own devices, fill in their own settings and invite their own people.
The two sides
| The vendor (your team) | The tenant (your customer) | |
|---|---|---|
| Works in | The workspace, with no tenant selected | Their own tenant |
| Builds | The application, dashboards, SCADA screens, workflows | Nothing — the design is already there |
| Defines | Which settings every customer must supply (tenant variable templates) | The values of those settings (tenant variables) |
| Owns | Workspace variables shared by everyone — API keys, endpoints | Their devices and device groups |
| Invites | Engineers and support staff into the workspace | Their own staff into the tenant |
| Sees | Every tenant | Only their own devices, events, dashboards and SCADA screens |
Put simply: the workspace is the product, a tenant is one installation of it.
How one design serves every tenant
Nothing is copied when you create a tenant. Dashboards, SCADA screens and workflows exist once, at workspace level, and resolve to the right tenant at the moment they run:
- Dashboards and SCADA screens run in the context of the tenant selected in
the sidebar. Device and event queries return only that tenant's devices, and
{{tenant.variables.KEY}}resolves to that tenant's value. Northside Bakery and Harbor Cold Storage open the same dashboard and each sees their own plant. - Workflows started by a tenant's device run with that tenant's variables, and their device blocks (Find Devices, device actions) reach only that tenant's devices. One alarm workflow covers every customer, and an event at one customer can never act on another customer's equipment.
- Workspace variables (
{{workspace.variables.KEY}}) are the same for every tenant.
So when you fix a dashboard or improve a workflow, every customer gets the change at once.
With no tenant selected, dashboards show only devices that belong to no tenant — handy for a test bench of your own devices. Workflows that a tenant's device did not start (a schedule, a manual run, a device with no tenant) get no tenant variables, and their device blocks reach every device in the workspace.
Setting up a customer
The walkthrough below follows a vendor, Acme Machines, onboarding a bakery as a new customer. It assumes the application, dashboards and workflows are already built in the workspace.
Vendor: declare the per-customer settings
Anything that differs between customers — a site name, who gets the alarm emails, a temperature limit — becomes a tenant variable template. Open Settings → Tenants and click Add Variable Template:
Each template has a key, a description the customer will read, and an optional
default. Keys are sanitized on save: anything outside A-Z, a-z, 0-9 and
_ is stripped. Reference the key in your dashboards and workflows as
{{tenant.variables.SITE_NAME}} instead of typing a value.
Templates are declared once and apply to every tenant. Only the workspace owner and admins can edit them.
Vendor: create the tenant
On the same page, click Create Tenant and name it after the customer:
Tenants can be created, renamed and deleted by the workspace owner, admins and operators.
Vendor: invite the customer
Click Users next to the tenant, then Invite User. Enter the customer's email and pick a role — usually Admin for the person who will run the installation:
The invitation is emailed and is valid for 7 days. The link is also shown in the table, so you can copy it and send it yourself. Inviting the customer into the tenant only — never into the workspace — is what gives them their narrow, customer-facing view.
Customer: accept the invitation
The customer opens the link and either creates an account or signs in with an existing one:
Customer: fill in their settings
On sign-in the customer lands directly in their tenant. Under Settings → Tenant Settings they see every key the vendor declared and fill in their own values:
Note the sidebar: no Designer, no Workflows, no Data Sources, no workspace settings. The customer configures, they don't design.
Customer: add their devices
Under Devices the tenant admin adds their own devices with + New Device, and can organise them into device groups running the vendor's application. They see only their own devices — the other customers' devices, and the vendor's own test devices, are invisible to them:
From here the vendor's dashboards, SCADA screens and workflows work for this customer with no further setup. The customer can invite their own staff from Settings → Tenant Settings, as tenant admins or read-only tenant members.
Personal space
When no workspace is selected the switcher shows Default Workspace. This is not a real workspace — it is your personal space, and everything in it belongs to your account alone. It cannot be shared, has no members, no roles and no tenants.
Move to a workspace as soon as a second person needs access. Content is not transferred automatically between your personal space and a workspace, so it is worth choosing before you build much.
Workspaces
What lives in a workspace
- Applications and project versions (firmware snapshots)
- Devices and device groups
- Dashboards, SCADA screens and data sources
- Workflows and their runs
- Workspace variables and tenant variable templates
- Audit logs, invites and members
Creating and switching
The workspace switcher sits at the top of the sidebar:
- Create Workspace — name it and you become its owner
- Switch Workspace — pick another workspace, or Default Workspace to return to your personal space
The selected workspace scopes the whole application. Devices, dashboards and workflows you see in the sidebar are the ones belonging to it.
Workspace settings
With a workspace selected, the sidebar gains a Workspace Settings group:
| Page | Contents |
|---|---|
| General | Workspace name and logo, and the Danger Zone for deleting the workspace |
| Members | Members and their roles, plus pending invitations — see Roles & Permissions |
| Variables | Workspace variables |
| Import / Export | Export the workspace as a reusable bundle, or import one |
| Audit Logs | Who did what, and when |
Deleting a workspace requires typing its name to confirm, and removes every tenant, device, group, dashboard, SCADA screen, workflow, project, firmware and audit log inside it. There is no undo.
Tenants
A tenant holds:
- its devices and device groups
- its variable values, one per tenant variable template
- its users, each a tenant admin or tenant member
Everything else — applications, dashboards, SCADA screens, workflows — is shared from the workspace, as described in How one design serves every tenant. Tenants are managed under Settings → Tenants, available to the workspace owner, admins and operators.
Selecting a tenant
Once a workspace has at least one tenant, a tenant switcher appears in the sidebar below the workspace switcher. Use Switch Tenant to scope the interface to one tenant and Exit Tenant View to return to the whole workspace:
Workspace owners, admins and operators can switch between every tenant. Everyone else is placed in their tenant automatically and cannot leave it.
A device or device group is assigned to whichever tenant is selected at the moment you create it, and that assignment cannot be changed afterwards. Select the tenant before adding devices on a customer's behalf.
Variables
Variables are what let one design serve many customers. Instead of hard-coding a broker address or a site name into a dashboard or workflow, you reference a variable and let the workspace or the tenant supply the value.
| Defined by | Value set by | Same for every tenant? | Reference | |
|---|---|---|---|---|
| Workspace variable | Owner / admin | Owner / admin | Yes | {{workspace.variables.KEY}} |
| Tenant variable | Owner / admin, as a template | Each tenant | No | {{tenant.variables.KEY}} |
Workspace variables
Workspace Settings → Variables. Use them for API keys, endpoints and configuration strings that are the same for every customer. Values are masked in the table and can be revealed individually. Reading them requires workspace membership; only the owner and admins can add, edit or remove them. When a workspace is exported, values are replaced with placeholders so secrets never travel inside a bundle.
Tenant variables
Declared as templates under Settings → Tenants, filled in per tenant under Settings → Tenant Settings — see Setting up a customer. Tenant admins edit their own values, as can workspace owners, admins and operators.
Audit logs
Workspace Settings → Audit Logs records who did what. Entries cover firmware assignments, variable writes, table changes, commands, group setting pushes and workflow changes, each with the acting user's email, the affected devices and a timestamp.
Scope follows the tenant switcher: with a tenant selected you see that tenant's entries, and without one you see the workspace entries that belong to no tenant. Audit logs are readable by the workspace owner and admins.
Exporting and importing a workspace
Workspace Settings → Import / Export exports the workspace as a bundle — applications, firmware snapshots, dashboards, workflows and tenant variable templates, with variable values replaced by placeholders. A bundle can be imported as a new workspace, added as copies to an existing one, or used to update a workspace that was imported from an earlier bundle of the same source. That's how you keep a design workspace apart from production and ship releases between them — see Deploying to Many Sites.
An imported workspace records the bundle id and version it came from, shown at the top of the page.
Putting it together
A typical machine builder ends up with:
- One workspace for the company, owned by the engineering lead.
- Engineers as members — they build the application, the dashboards and the workflows at workspace level, with no tenant selected.
- A support person as operator — they onboard each new customer as a tenant and install their devices, without being able to change the design.
- Tenant variable templates for anything that differs per customer — site name, contact email, thresholds.
- One tenant per customer, each with the customer's admin invited into the tenant only. They fill in their variables, add their devices and invite their staff — and see their own installation and nothing else.
See Also
- Roles & Permissions — who can do what in a workspace and a tenant
- Deploying to Many Sites — the recommended workflow for reselling one application
- Workspaces & Tenants API — automate all of the above
- Devices API