# API credentials for clients in a multi-tenant setup **URL:** \ **Category:** Get Help\ **Tags:** multi-tenant, m2m\ **Created:** [May 9, 2022, 5:42am UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099 "2022-05-09T05:42:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![subtlestag](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/subtlestag/32/30677_2.png) [@subtlestag](https://community.auth0.com/u/subtlestag)\ **Post date:** [May 9, 2022, 5:42am UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/1 "2022-05-09T05:42:43Z")
Hi, I am designing a multi-tenant authentication/authorization setup, in which different client applications (tenants) will require access to an API that I manage. Just to clarify, each tenant will run several NodeJS/Go applications on separate servers, all of which require scopes/permissions that set it apart from the other tenants. I’ve gone over the Auth0 pricing page, and I’m trying to understand if Auth0 would be a good fit for my case, because it seems that I would have no way of avoiding the “Enterprise” plan if I understand the different application types correctly. After going over the documentation, it seems that the most fitting implementation would be to create a M2M App (client ID + client secret pair) for each of my clients (tenants). Each client would generate an access token using the id+secret and use that to access the API. On the server side, I would verify the validity of each token and make sure it contained the required scopes, and grant access accordingly. Clients would use this token until it expires, then generate a new token using the same id+secret pair. If I were to use this design, it seems that I **would reach a large number of M2M Apps as my tenant list grows** , and if I understand correctly, at ~100 tenants I would require the “Enterprise” plan, which surely exceeds my budget at this point in time. Is there a better way of implementing the requirements I’ve described, which doesn’t lead to “endless” M2M Apps? It doesn’t seem very scalable, so I guess I must be missing something. Thank you for any input. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 20, 2022, 10:45pm UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/3 "2022-05-20T22:45:45Z")
Hi @subtlestag, Thanks for reaching out. If I understand your requirements correctly (dynamically issuing client credentials to third-party applications), you are going to run into [application entity limits](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/entity-limit-policy#self-service-paid-subscription-limits) and you will need an enterprise subscription to proceed beyond the Self-Service limits. You can take a look at our startup plan, which is meant for early-stage companies that are preparing to scale. [https://auth0.com/startups](https://auth0.com/startups) ---
**Author:** ![subtlestag](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/subtlestag/32/30677_2.png) [@subtlestag](https://community.auth0.com/u/subtlestag)\ **Post date:** [May 22, 2022, 3:56pm UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/4 "2022-05-22T15:56:36Z")
Hi @dan.woda, thank you for the response. Is there a way I can achieve a similar result without reaching the application entity limits? Are M2M Applications the only way to get unique credentials per tenant (app running on a user’s server)? Is there a way that Users can generate tokens that have qualities similar to M2M Apps? Thank you ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 23, 2022, 3:49pm UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/5 "2022-05-23T15:49:15Z")
Hi @subtlestag, Issuing client credentials would be the OAuth2 way to handle this scenario. Returning a token would require a set of credentials. ---
**Author:** ![subtlestag](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/subtlestag/32/30677_2.png) [@subtlestag](https://community.auth0.com/u/subtlestag)\ **Post date:** [May 24, 2022, 3:25pm UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/6 "2022-05-24T15:25:16Z")
I see. Looking at this from another angle, if a M2M App is authorized to access a specific API (`http://myapi/v1`), with a certain list of Permissions (e.g. `read:contacts`, `write:calendar`), would it be possible to request an access token that only grants a subset of the Permissions? In other words, request a token (`https://me.auth0.com/oauth/token`) using a client ID and client secret, but only for `read:contacts`? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 28, 2022, 10:36pm UTC](https://community.auth0.com/t/api-credentials-for-clients-in-a-multi-tenant-setup/83099/7 "2022-06-28T22:36:02Z")