Introduction
Multi-tenancy is mostly about boundaries. Each request carries a site identity, and every layer must respect it — without leaking one brand's data into another.
Resolving the tenant
We resolve a site from its domain via the control-plane registry, then map it to a Medusa sales channel. The x-site-id header is never trusted from the client — scoping is enforced server-side on every route.
A typed BFF with Eden
The storefront talks to an ElysiaJS BFF over Eden, so request and response types are shared end-to-end. Engines (Medusa, Convex) sit behind the BFF and degrade gracefully when one is down.
Watch it in action
Prefer video? ▶ Watch the walkthrough
Built on Bun + ElysiaJS, served through Convex. Questions welcome in the comments.