Multi-Tenant Setup

Provision the tenant and domain

Use onboard_client.py rather than hand-typed calls — it’s idempotent and prints the remaining checklist:

uv run python scripts/onboard_client.py \
  --api-url https://api.mael.in \
  --email operator@agency.example \
  --tenant-slug acme-clinic \
  --tenant-name "Acme Clinic" \
  --domain acmeclinic.example \
  --display-name "Acme Clinic — Primary Care"

Connect Google Search Console + GA4

The client grants property access to your platform’s Google OAuth app, then:

GET /api/v1/integrations/google_search_console/oauth/authorize
GET /api/v1/integrations/google_analytics/oauth/authorize

Initial sync pulls ≥90 days of history; daily scheduled sync keeps it current.

Connect WordPress

Self-hosted sites use an application password, not OAuth:

curl -X POST https://api.mael.in/api/v1/integrations/wordpress/connect \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"site_url": "https://acmeclinic.example", "username": "...", "application_password": "..."}'

Validate against a throwaway WordPress site first, never a client site, before the first real publish.

Connect Ahrefs and Slack

Ahrefs requires an active subscription (rate-limited connector). Slack enables approval notifications with interactive approve/reject buttons — see Workflow Engine → Human approval gates.

Run a technical audit

Confirm the crawler respects the client’s robots.txt and doesn’t trip shared-hosting rate limits before running any content workflow:

curl -X POST https://api.mael.in/api/v1/workflows/technical-audit/trigger \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"domain_id": "'"$DOMAIN_ID"'"}'

Set the composite quality floor

For YMYL (medical) tenants, set composite_min ≥ 80 on the content workflow’s inputs — the content-evaluation gate reads this per-run.

RLS isolation check

Before treating a new tenant as production-ready, confirm cross-tenant isolation directly — not just trust the design:

# Tenant A's token must not be able to read tenant B's domains
curl https://api.mael.in/api/v1/tenants/$TENANT_B_ID/domains \
  -H "Authorization: Bearer $TENANT_A_TOKEN"
# Expect 403 or 404 — never tenant B's data

Get Started

Architecture

Deployment

SDK

CLI

Guides

Examples

Resources

Multi-Tenant Setup

RLS isolation check

Multi-Tenancy architecture

​RLS isolation check

Multi-Tenancy architecture

RLS isolation check