Multi-Tenant SaaS Routing

Modern SaaS applications—such as Slack, Jira, Shopify app ecosystems, and enterprise multi-tenant portals—often partition customer workspaces by subdomain:

• https://acme.yourapp.com
• https://stark-industries.yourapp.com
• https://wayne-enterprises.yourapp.com

Testing this locally with standard tunneling tools is notoriously difficult due to DNS and TLS certificate limitations.

🚫 The Wildcard TLS LimitationCopy Anchor Link

Standard wildcard TLS certificates (e.g. *.tunnel.explita.ng) issued by Let's Encrypt only validate a single DNS label level:

Issuing nested multi-level wildcard certificates requires complex DNS automation, rate limits, and custom edge routing.

💡 The Solution: Double Hyphen (--) DelimiterCopy Anchor Link

Explita Tunnel solves this elegantly with the double hyphen (--) syntax:

https://{tenant}--{parentSubdomain}.tunnel.explita.ng

Because acme--myapp contains only hyphens, it forms a single DNS label that is 100% valid under standard single-level *.tunnel.explita.ng wildcard certificates.

How It Works in PracticeCopy Anchor Link

1. Start your local tunnel with a base subdomain:

   Copy Text

   eta 3000 -s myapp

2. Your base tunnel is live at https://myapp.tunnel.explita.ng.
3. Now send requests to any arbitrary tenant prefix using --:

   Copy Text

   curl https://acme--myapp.tunnel.explita.ng/api/workspace
   curl https://nike--myapp.tunnel.explita.ng/dashboard
   curl https://stripe--myapp.tunnel.explita.ng/webhook

4. The gateway identifies myapp as the active tunnel owner, routes the request across your existing connection, and injects tenant contextual headers.

📨 Injected Explita HeadersCopy Anchor Link

When a multi-tenant request reaches your local application, the gateway extracts and provides parsed metadata headers:

[!NOTE] All incoming caller headers starting with x-explita-* are strictly stripped at the gateway before routing. An external attacker cannot spoof tenant IDs or inject malicious values into these headers.

💻 Framework Integration ExamplesCopy Anchor Link

Next.js (App Router Middleware)Copy Anchor Link

In your middleware.ts:

import { NextResponse, type NextRequest } from "next/server";

export function middleware(req: NextRequest) {
  const url = req.nextUrl;
  const hostname = req.headers.get("host") || "";

  // 1. Check for Explita Tunnel tenant header (local dev)
  let tenant = req.headers.get("x-explita-tenant");

  // 2. Production fallback: parse tenant from production host (e.g. acme.yourapp.com)
  if (!tenant && hostname.includes(".yourapp.com")) {
    tenant = hostname.split(".")[0];
  }

  if (tenant) {
    // Rewrite path to tenant workspace route
    url.pathname = `/workspaces/${tenant}${url.pathname}`;
    return NextResponse.rewrite(url);
  }

  return NextResponse.next();
}

Express.jsCopy Anchor Link

import express from "express";

const app = express();

app.use((req, res, next) => {
  // Check Explita Tunnel header or hostname
  const tenant = req.headers["x-explita-tenant"] || req.hostname.split(".")[0];

  req.tenant = tenant;
  next();
});

app.get("/dashboard", (req, res) => {
  res.json({
    message: `Welcome to workspace: ${req.tenant}`,
    tunnelRouted: req.headers["x-explita-tunnel"] === "true",
  });
});

app.listen(3000);

🧪 Testing Nested Multi-Level PrefixesCopy Anchor Link

If your SaaS platform organizes hierarchies (e.g. region and customer like eu.acme.yourapp.com), you can chain double hyphens:

curl https://eu--acme--myapp.tunnel.explita.ng

The gateway parses this and populates:

• x-explita-tenant: "eu--acme"
• x-explita-subdomain-parts: "eu,acme"

Your application can split on commas to resolve the entire tenant hierarchy instantly.