Skip to main content
Customer-scoped pages let one underlying page serve multiple customers, with each customer’s signed-in view filtered to the metrics, services, and SLOs in their contract. The same page can also apply per-customer SLO targets (for example, an enterprise customer with 99.99% reads against a different threshold than a standard customer signed at 99.9%).

​
Prerequisites

  • A Pro plan or higher.
  • The audience already authenticates against an Identity Provider capable of signing RS256 JWTs.
  • A list of customers in the console. Open Customers, then New customer, and set each customer’s External ID (the value your tokens carry in sub).

​
Configure the page

1

Switch the page to customer-scoped mode

Open the page in the console, then Access. Set:
  • Mode: Customer-scoped (JWT + grant).
  • Public key (PEM) or Or JWKS URI: same as JWT mode.
Save. Observer reads the token’s sub claim and matches it to a customer’s External ID.
2

Grant customers access to the page

Open Customers, select the customer, and add the page under Page access grants. Repeat for each customer who is allowed to view the page. Customers without a grant receive a 403 even with a valid token.
3

Apply per-customer SLO targets (optional)

Open a customer, then SLO target overrides. Add an override with:
  • The SLO whose target should be customer-specific.
  • The customer’s contracted target percentage.
When the customer-scoped page renders for that customer, the SLO strip uses the override target. Other customers viewing the same page see the default SLO target.
Same backend, different verdictsCustomer scopes apply at render time. A single underlying metric can therefore back a 99% agreement with one customer and a 99.99% agreement with another, without duplicating the metric definition or the agent’s collection work.

​
Issuing tokens

Issue tokens for each customer with the agreed claim set.
claims
sub must equal the customer’s External ID; tokens older than one hour (by iat) are rejected.

​
Behaviour

  • A customer without a grant for the page gets 403 even with a valid token.
  • An expired token returns 401; issue a fresh token.
  • SLO overrides are read on every render and require no caching on the consumer side.