Multi-Tenant Architecture: Shared Schema vs Isolated Database, and When to Switch
The shared-schema-with-a-tenant-id approach that got you to your first hundred customers is not the same decision as your thousandth. Here is how we decide.
The day you ship your first public API is the day backward compatibility stops being optional. Most teams find this out the hard way.
An internal API can change whenever the team that owns it wants. A public API, the moment a single customer builds an integration against it, has effectively frozen — every field, every status code, every quirk of behaviour is now something someone else's production system depends on, whether or not you documented it as a guarantee.
We lean toward date-based versioning for anything with a meaningful external developer audience — it lets you evolve the API continuously without ever forcing an integration to break on a schedule you control but they do not.
Adding a new required field, changing an enum's allowed values, or even reordering fields in a response some client happens to parse positionally — teams call these "minor" and ship them without a version bump, then field a support ticket from the one customer whose integration silently broke. Define, in writing, exactly what counts as a breaking change for your API before the first external integration exists, so the definition is not renegotiated under pressure later.
A published deprecation policy — minimum notice period, a sunset date communicated directly to affected API keys, not just a changelog entry — turns API evolution from a trust-eroding surprise into a predictable, professional process. The teams that get this right treat their API version history the way they treat their uptime SLA: a commitment, not a suggestion.
More from the same category.
The shared-schema-with-a-tenant-id approach that got you to your first hundred customers is not the same decision as your thousandth. Here is how we decide.
Usage-based pricing sells well on a pricing page. The metering, reconciliation and dispute-handling behind it is where most implementations quietly fail.
A hardcoded "admin" and "member" role gets you to your first enterprise deal. It does not survive contact with their security questionnaire.
Thirty minutes with the people who would actually do the work — no discovery deck, no account manager.