Exto Console Docs

Appearance

Customers, Tenants & Instances ​

These three nouns appear everywhere in the Console. Getting them right makes the rest of the guide read cleanly.

Customer ​

A customer is a company you have a contract with. Customers are the unit of:

  • Contracting and billing. A customer is on exactly one plan at a time, and one or more versions of that plan over time.
  • Identity. A customer has its own Zitadel organisation, its own password policy, its own MFA policy, and its own identity providers.
  • The customer portal. Every URL under /customers/:customerId/... is scoped to one customer.

A customer can have many tenants, but a tenant always belongs to exactly one customer.

Customers have a lifecycle:

  • Active — the normal operating state.
  • Suspended — paused for non-payment, abuse, or admin action. Users cannot sign in.
  • Churned — the customer is gone. Data is retained per policy but the customer cannot be reactivated automatically.

See Lifecycle Statuses for transition rules.

Tenant ​

A tenant is one customer's environment inside one instance. Tenants are where the customer's own end-users sign in to do work.

A tenant has:

  • A name and a code (the immutable identifier the underlying instance uses).
  • An environment tag — DEV, QA, UAT, STAGING, DEMO, PRE_PROD, or PROD. Environment is used by billing rules and release pipelines.
  • An instance — the hosted environment where it actually runs. A tenant lives on exactly one instance at a time but can be moved.
  • A licensing profile — user license count, project license count, license expiration, feature flags (GeoTagging, Angular Dashboard, PowerBI Dashboard), and module list.
  • Primary contact and address information for the customer.

Tenants have a lifecycle:

  • Provisioning — being created on the target instance.
  • Active — operating normally.
  • Suspended — paused; users cannot sign in to the tenant.
  • Deleted — terminal. Mongo data purged; PG row retained for audit. Delete requires a reason and is not reversible.

Tenants can be moved to a different customer (with care; assignments and grants are relinked) and migrated to a different instance via the Migrations page.

Instance ​

An instance is a hosted environment that runs tenants. Think of it as a Kubernetes cluster or a hosted backend.

An instance has:

  • A name, region, and environment tag.
  • A capacity — the maximum number of tenants it can host.
  • A set of services — the deployed pods that make up the application. Each service has an image, a version, replicas, and reports its own health.
  • A set of environment variables — global values plus per-instance overrides. Variables can be plain values, references to Kubernetes secrets, or references to ConfigMaps.

Instances have a lifecycle:

  • Provisioning — being prepared. After the Console creates an instance, the operator deploys the Console agent into the cluster using the issued bootstrap credentials. Once the agent reports in, the instance becomes active.
  • Active — operating normally. Health is reported via the agent's heartbeat.
  • Inactive — heartbeat missing for long enough that the Console no longer trusts the state.
  • Decommissioned — retired permanently.

How they fit together ​

A customer "Acme Corp" buys the "Professional" plan.
  └─ Tenant "acme-prod"   (env: PROD)    runs on instance "prod-east-1"
  └─ Tenant "acme-uat"    (env: UAT)     runs on instance "stg-east-1"
  └─ Tenant "acme-dev"    (env: DEV)     runs on instance "stg-east-1"

Diagram

Replace the ASCII block with a real diagram: customer node connected to its tenants, each tenant connected to its hosting instance. Colour each tenant by environment.

When a release ships, the Console looks at the pipeline configuration, finds which instances are in each stage, and deploys to those instances. Tenants on those instances pick up the change automatically — there is no per-tenant deployment.

When a tenant is moved between customers, its environment, licensing, and instance stay the same; only ownership and billing change. When a tenant is migrated, the Console packages its data, ships it to a different instance, and updates routing. See Migrations.