Tenant onboarding
How Twentyfirst provisions a new client workspace using the control plane + on-prem workspace model.
Roles
| Role | Responsibility |
|---|---|
| Platform operator | Customers, instances, config, licenses (control app) |
| Tenant admin | Users, local branding review (workspace /admin) |
| Client IT | Install workspace, DNS/TLS, model endpoint, firewall rules |
| End users | Chat, library, RAG |
Checklist
1. Gather client inputs
- Legal entity name and workspace display name
- RAG required? TTS/STT?
- Model endpoint URL, API key, default model IDs
- Auth: credentials, Google Workspace, Microsoft Entra ID, or combination
- Connected (outbound HTTPS to control) or air-gapped?
- Data residency and retention requirements
2. Provision in control (/ops)
- Create customer — name, billing email.
- Create instance — name, initial config (branding, model profile, entitlements).
- Copy pairing token (connected) or license + config bundle (air-gapped).
3. Client installs workspace
- Deploy
apps/chat.twentyfirst.ai(Docker or Node on client infra). - Configure
DATABASE_URL,MODEL_*,NEXTAUTH_*. - Connected: set
CONTROL_PLANE_URL,INSTANCE_PAIRING_TOKEN, matchingCONTROL_PLANE_SIGNING_KEY. - Air-gapped: set
LICENSE_FILE_PATH, import config bundle in Admin. - Run
npm run db:pushand create initial admin user (or use seed in dev only).
4. Pair and verify
Connected
- Admin → Sync now (or cron hit
/api/cron/sync). - Confirm instance shows last seen in control.
- Client admin logs in; send a test chat message.
Air-gapped
- Import config bundle in workspace Admin.
- Verify license expiry in Admin panel.
- Re-import config bundles when operators publish updates.
5. Authentication
Email / password
Create users with bcrypt password_hash and memberships rows, or use workspace seed in dev:
npm run db:seed -w @repo/chat.twentyfirst.ai
Default dev admin: admin@demo.local / ChangeMe!123
Google / Microsoft OAuth
Configure AUTH_GOOGLE_* or AUTH_MICROSOFT_* on the workspace deployment. Redirect URI: https://<workspace-host>/api/auth/callback/...
6. Handoff
- Tenant admin credentials or SSO instructions
- Model endpoint documentation (client-owned)
- Support contact and instance ID for control lookups
- Usage/billing review cadence (control
/ops/usage,/ops/billing)
Ongoing operations
| Task | Where |
|---|---|
| Change branding / model config | Control → publish config revision → workspace syncs |
| Suspend client | Control → instance status → workspace blocks on next sync |
| Usage / billing | Control usage ingest from workspace sync |
| Add users | Workspace tenant admin |
See deployment.md for production hardening.