Configure customer-scoped pages

Customer-scoped pages let one underlying page serve multiple customers, with each customer's signed-in view filtered to the metrics, services, and SLOs in their contract. The same page can also apply per-customer SLO targets (for example, an enterprise customer with 99.99% reads against a different threshold than a standard customer signed at 99.9%).

Prerequisites#

• The audience already authenticates against an Identity Provider capable of signing JWTs.
• A list of customers in the console (open Customers, then New customer, and capture each customer's identifier).

Configure the page#

1. •

   Switch the page to customer-scoped mode#

   Open the page in the console, then Access. Set:

   • Mode: customer_scoped.
   • Public key or JWKS URL: same as JWT mode.
   • Customer claim: the JWT claim Observer should read to identify the customer. Common choices are sub, customer_id, or a custom claim such as obs_customer_id.

   Save.

2. •

   Bind customers to the page#

   Open the page, then Access, then Customers. Add each customer who is allowed to view the page. Customers without a binding receive a 403 even with a valid token.

3. •

   Apply per-customer SLO targets (optional)#

   Open a customer, then SLO overrides. Add an override with:

   • The SLO whose target should be customer-specific.
   • The customer's contracted target percentage.

   When the customer-scoped page renders for that customer, the SLO strip uses the override target. Other customers viewing the same page see the default SLO target.

Issuing tokens#

Issue tokens for each customer with the agreed claim set. The customer-claim value must match a customer in the binding list.

{
  "iss": "https://your-idp.example",
  "aud": "observer-status-page",
  "sub": "user-1234",
  "obs_customer_id": "acme-cloud",
  "exp": 1716480000
}

Behaviour#

• Pages without a binding return 403 even with a valid token.
• Token expiry returns 401 and the embedded view re-fetches a token.
• SLO overrides are read on every render and require no caching on the consumer side.