Hey all, I am implementing a multi-tenant site where each clinic is a separate project. During the auth process I need to reference a client_application_secret and id (similar to this example: https://github.com/medplum/medplum/tree/main/examples/medplum-nextauth-demo). This is specific to the project, so any time I onboard a new clinic it looks like I will have to add a new .env variable corresponding to the client_application_secret and id for that project. This seems like a non-scalable process and would love to know if there is a workaround for this. Thanks in advance!

@liam_collins__ , it's importnat that the CLientApplication secret always be kept on the server side. Are you using NextJS + the NextAuth framework, or another framework?

I am using NextJS + the NextAuth framework. When I use the medplum oauth endpoint (accessed server side) I need to pass in a client id, and per my understanding the clientApplication is specific to each project.

Hi @liam_collins__ , there are a few options, but unfortunately in general looking up Project ids is something that requires super admin access, which WE STRONGLY NOT RECOMMEND GIVING TO CLIENT APPs

Thanks @rahul1 are there any options for multi tenant hosting without self hosting the medplum server? From my understanding super admin access is only available on self hosting

That's right. The not-so-great option is to have a hard-coded list on the client from "clinic" to "client_id". The root of the problem is that we can't expose a list of all projects in the system on our hosted system

@liam_collins__ did you ever solve your problem here? I'm jumping in as I'm setting up the same thing now, albeit on a GCP self hosted instance. I'm guess this page rolled out between now and the last comment on this thread? https://www.medplum.com/docs/access/multi-tenant-access-policy In which case it seems that the recommended practice now is to have a single "multi-tenant" project with an access policy that limits access to different orgs?