multi-product SaaS gateway
Multi-Product Suite Gateway: Buyer's Guide for Identity, Entitlements & Handoff
Complete guide to evaluating a suite gateway platform—tenant model, SKU entitlements, service links, auth handoff, and federated launcher without shared databases.
Multi-Product Suite Gateway: Buyer's Guide for Identity, Entitlements & Handoff
Growing operators do not want twelve logins, twelve billing relationships, and twelve disconnected tenant models. A suite gateway sits above CRM, POS, Finance, HRM, Inventory, Receptionist, CMS, and every other modular product — handling identity, org structure, SKU entitlements, service-link registration, and short-lived handoff tokens.
Tekvers built a production Suite Platform as the control plane for modular business software. This guide helps suite operators, product owners, enterprise buyers, and engineering leads evaluate what to buy, what to build, and what will fail when you add the next module.
Platform: /products/platform · Related case study: /projects/modular-enterprise-suite
Related articles: multi-product suite use cases · product handoff tokens · POS vs ERP
Who needs a suite gateway?
- Operators selling CRM today and Finance next quarter — without redeploying every product
- Product teams shipping independent NestJS APIs and Next.js portals on their own cadence
- Enterprise buyers who need one identity layer across modular business software
- Developers tired of hardcoded env vars for sibling product URLs and API keys
- Leadership wanting one federated dashboard — not five separate admin consoles
If you only need a single monolith ERP, see ERP digital transformation. If you need independently shippable products under one login, you need a gateway.
Core capabilities checklist
| Capability | Why it matters |
|---|---|
| Org tenants & membership | One tenant model across every entitled product |
| Per-tenant SKU entitlements | Turn CRM, finance, receptionist on/off without redeploy |
| Service link registry | API base URLs, portal URLs, link modes — not scattered secrets |
| Auth handoff | Single-use tokens to open product portals without second login |
| Suite home / launcher | Federated view of entitled products and remote metrics |
| Audit log | Who changed entitlements, service links, or membership |
| Billing surface | Plan/SKU exposure for downstream billing integration |
Pain points a gateway solves
Fragmented product access
Each new module means another URL, another API key, and another onboarding flow. Staff forget which portal does what.
No unified entitlement model
Sales sells CRM today and Finance next quarter, but there is no single place to turn SKUs on or off per tenant.
Cross-product linking is ad hoc
Integrations devolve into hardcoded URLs and shared secrets scattered across env files instead of a registry operators can manage.
Operators lack a federated view
Leadership wants one dashboard showing counts and health across products — not five separate admin consoles.
Solution moments (what good looks like)
Monday morning — new tenant goes live. A suite operator creates an org tenant, enables CRM and Receptionist SKUs, registers service links with each product's API base URL and portal URL, and invites the owner. The owner logs into Suite Home and sees both products ready to launch.
Sales closes an upsell. Finance was not entitled last month. The operator toggles the finance SKU on, registers the Finance service link, and the customer's Suite Home immediately shows Finance in the launcher — no redeploy.
Staff opens CRM from Suite Home. The user clicks CRM. Platform issues a single-use handoff token. CRM portal validates it and opens a session — no second login prompt.
Audit review after a config change. An operator pulls the audit log to see who changed entitlements, added a service link, or modified tenant membership yesterday.
Handoff vs SSO
Handoff issues a short-lived, single-use token to open a specific product portal session. It is designed for suite navigation — click CRM in the launcher, land in CRM already authenticated.
SSO (SAML, OIDC federation) is enterprise-wide identity across unrelated apps. You can layer SSO later; handoff solves the immediate "one suite home" problem without coupling product session stores.
Build vs buy vs adapt
| Path | When it fits |
|---|---|
| Off-the-shelf identity (Auth0, Clerk) | Single product, no entitlements or service registry |
| Custom gateway | Multi-product suite with SKU packaging and federated launcher |
| Monolith ERP admin | Legacy single-release-train — hard to sell modules independently |
| Greenfield per product | Maximum isolation — but operators drown in logins without a gateway |
Tekvers offers custom software development and ships the Suite Platform as an adaptable gateway scaffold.
Implementation phases
- Provision tenant — Create org, companies, and member users in Platform
- Entitle products — Toggle SKUs on for the tenant's subscription plan
- Register service links — Point each entitled product's API and portal at Platform's registry
- Launch from Suite Home — Users open products via handoff; each product runs independently
Technical foundation (honest scope)
- Stack: NestJS API + Next.js portal, TypeScript contracts, Postgres with prefixed schemas
- Runtime: JSON file store locally; Postgres when configured
- Status: Gateway scaffold — runnable locally with demo tenant
- Honest scope: Federation aggregates remote metrics when service links are configured; each product owns its persistence boundary
Platform does not store CRM or Finance domain data — only tenants, memberships, entitlements, service links, and audit events.
FAQs
Can I run Platform without other products? Yes. Platform is independently runnable. Products connect when you register service links and entitle SKUs.
What happens when a product is not entitled? It disappears from Suite Home. The product API remains independently reachable if you have its credentials.
Is this the same as a legacy ERP admin module? Conceptually yes — it evolved from monolithic ERP admin patterns, restructured as a standalone gateway with clear product boundaries.
Next steps
- List every product SKU you sell or plan to sell
- Map which portals and APIs need service links today
- Decide v1 scope: identity + entitlements vs full federated metrics
Get a scoped review from Tekvers: Contact · Suite Platform.