Home/Documentation/Per-App User Isolation Without Shared Identity
FeaturesArchitecture evaluation

Per-App User Isolation Without Shared Identity

Keep the same email address isolated across separate apps so users, roles, providers, and tokens never merge by accident.

A lot of auth systems assume one global directory and then add tenants on top. 1Auth starts from the opposite direction: each app owns its own users, and the infrastructure is what gets shared.

What teams need from this feature

These are the operational constraints that usually turn a simple auth flow into infrastructure work.

  • One email address can represent different products, contracts, and permissions across the same company portfolio.
  • Support and admin actions become risky when disabling or editing one account can affect another product.
  • Cross-app token reuse becomes a silent vulnerability if tenant scope is only implied, not enforced.

How 1Auth handles it

1Auth ships the primitive as part of one backend instead of forcing each product to rebuild the same boundary.

Unique identity boundary per app

The database model treats app_id plus email as the identity boundary, which keeps same-email accounts independent by design.

Audience and app checks in JWTs

The token model reinforces the same boundary so backend consumers can reject tokens that belong to another app.

Scoped roles, orgs, and providers

Roles, OAuth account links, organizations, and teams stay local to the app instead of attaching to a shared global principal.

Good fit when

The product gets stronger when the auth model matches the boundary of the app, not the convenience of the provider.

  • Your products should never imply a shared account system or accidental SSO.
  • You support multiple brands, portals, or client-facing apps with different access rules.
  • You need a hard separation model that developers and support teams can reason about quickly.

FAQ

Questions teams ask before they ship

Can the same person register the same email in multiple apps?

Yes. That is a core design goal. The same human can hold separate accounts in different apps without those accounts being linked.

Do organizations replace per-app isolation?

No. Organizations add structure inside an app. They do not collapse separate apps into one shared identity system.