Hi Ton,

I would advise to host this API in an internal network and let a gateway set the tenant HTTP Header according to whoever is logged in.

That was not clear in the article.

Cheers,

M