---
title: "Tenant Onboarding"
description: "Create tenants, invite operators, and configure webhooks."
collection: "guides"
slug: "tenant-onboarding"
url: "https://naiza.ai/docs/guides/tenant-onboarding"
markdown: "https://naiza.ai/docs/guides/tenant-onboarding.md"
full_docs: "https://naiza.ai/docs.md"
product: "Naiza"
base_url: "https://api.naiza.ai/api/v1"
---

# Tenant Onboarding

> Create tenants, invite operators, and configure webhooks.

## Table of contents

- [1) Environments](#1-environments)
- [2) Create API Keys](#2-create-api-keys)
- [3) Choose Your Integration Surface](#3-choose-your-integration-surface)
- [4) Webhooks](#4-webhooks)
- [5) Sandbox Testing Checklist](#5-sandbox-testing-checklist)
- [6) Go-Live](#6-go-live)

This guide walks through the practical path from account creation to a production-ready integration.

## 1) Environments

Use separate tenants, API keys, webhook URLs, and secrets for each environment:

- Development
- Staging
- Production

Never reuse production keys outside production.

## 2) Create API Keys

1. Log in to the Naiza dashboard
2. Navigate to **Settings** -> **API Keys**
3. Create a key for each environment
4. Store the key in a secret manager or CI secret store

## 3) Choose Your Integration Surface

Pick the APIs that match your product surface:

- **Server-side risk decisions**: `POST /api/v1/decisions/evaluate`
- **Server-side event ingestion**: `POST /api/v1/events` (sync) or `POST /api/v1/events/async`
- **Browser signals**: `POST /api/v1/websdk/tokens` + `POST /api/v1/websdk/signals`
- **Operational automation**: lists + feedback + webhooks

## 4) Webhooks

1. Create a subscription: `POST /api/v1/webhooks/subscriptions`
2. Persist `signingSecret` immediately (returned once)
3. Implement signature verification using raw request bytes
4. Use `POST /api/v1/webhooks/subscriptions/:id/test` to validate connectivity

See [Webhooks API](https://naiza.ai/docs/api-reference/webhooks.md).

## 5) Sandbox Testing Checklist

- Validate `401` handling for missing/invalid keys
- Validate `400`/`422` handling for invalid payloads
- Validate `429` backoff behavior
- Confirm webhook retries do not double-apply side effects (idempotency)

## 6) Go-Live

- Enable monitoring dashboards for decision volume and error rates
- Define operational runbooks for key rotation and incident response
- Document internal ownership for webhook endpoint uptime

## Related documentation

- [Overview](https://naiza.ai/docs/guides/overview.md) — Base URL, authentication, decision types, risk scores, and rate limits.
- [Getting Started](https://naiza.ai/docs/guides/getting-started.md) — Make your first Naiza API call and verify your integration.
- [Web SDK — Install & CDN](https://naiza.ai/docs/guides/web-sdk-install.md) — Install the browser SDK via CDN, self-host, and verify ingest.
- [Quick Start](https://naiza.ai/docs/guides/quick-start.md) — Common operations for events, decisions, lists, and feedback.
- [Event Monitoring](https://naiza.ai/docs/guides/event-monitoring.md) — Model product events and turn rule outcomes into decisions.
- [AML Integration](https://naiza.ai/docs/guides/aml-integration.md) — Screen customers and counterparties against AML watchlists.
- [Integration Examples](https://naiza.ai/docs/guides/integration-examples.md) — Node.js, Python, cURL, and webhook handler examples.
- [Best Practices](https://naiza.ai/docs/guides/best-practices.md) — Production guidance for keys, idempotency, and enforcement.

---

*Source: [https://naiza.ai/docs/guides/tenant-onboarding](https://naiza.ai/docs/guides/tenant-onboarding) · Full docs: [https://naiza.ai/docs.md](https://naiza.ai/docs.md)*